While libgcrypt is written for general purpose computers in mind, it comes more hardware features available, which are considered not safe.
When users run the code of libgcrypt with those hardware, it's up to users to protect against attacks.
It is good for libgcrypt to publish something. How about the following as an initial start?
========================== ** Threat Model of libgcrypt For libgcrypt, as it's a library, it is intended to be used widely. Thus, users can run the code in any environments as they wish. However, there are hardware which may allow access to fine-grained side channel. Those hardware related threats are out of the scope of libgcrypt threat model. It's up to users not to offer any access to those side channels, if any. ==========================
We won't deny an improvement against such an attack, but we consider that as an improvement of implementation, and not handle as software vulnerability.