Using a `|` character with `gpg --agent-program` to specify arguments for the gpg-agent process is not officially supported. The docs describe it as "a regression test suite hack" [1].

This is easy to fix for the selftests where we create a temporary gnupg homedir. In that case we can safely write a gpg-agent.conf file with the required options and know that there is no pre-existing gpg-agent running for this homedir without the options set. However, in the more general case supported by oe.gpg_sign, we can't modify the configuration files in the gnupg homedir as this is likely to be provided and managed by the user. We also can't guarantee that there isn't already a gpg-agent process running which lacks the required options.

Fixing this in the general case is tricky. We may need to simply document the requirement for the gpg-agent to have the auto-expand-secmem option enabled and leave it to users to ensure that is set in their environments.

[1]: https://www.gnupg.org/documentation/manuals/gnupg24/gpg.1.html