Sensitive files like secret keys, revocation certificates, and just-decrypted
files shouldn't be visible to other users on a multi-user system. However, gpg
currently creates all of these files with the default permissions. Often, the
user's umask is improperly configured, so that the files are created with
permissions -rw-r--r--, instead of a more sane -rw-------. Even though the user
should configure their umask correctly, it seems like gpg should do this anyway.
Therefore, I propose that when these files are created, they are always created
without any permissions set for group and other.

A previous bug report [0] addressing only decrypted files was given an offer to
be turned into a feature request, but this never happened. In addition, the fact
that this affects exported secret keys and revocation certificates is more
troubling than decrypted files.