The Emacs fallback mode of Pinentry currently uses a Unix domain
socket (/tmp/emacs$UID/pinentry) to communicate with Emacs. However,
given that the caller of gpg is supposedly the same process as the
Emacs running pinentry.el, we could use FD passing instead:
+--------------------------+ | emacs | | create bidi pipe | +-------+----------^-------+ | |
- inherit fd (fork) | | | +-------v-----+ | | gpg | | +-------+-----+ |
| | 2. fd passing | 4. communicate through the fd | | +-------v-----+ | | gpg-agent | | +-------+-----+ | | |
- inherit fd (fork) |
| | +-------v----------+-------+ | pinentry | +--------------------------+
This requires changes to Emacs, GnuPG, and Pinentry, but it would
reduce the attack surface a bit and bring a better support for
multiple Emacs instances.