This works suprisingly well, without explicit invalidations i would not have expected that get icon is called automatically after the button or a subbutton is clicked. But I think that this then would require at least a test on the oldest supported version from us, too. Do we even have an old GpgOL test system?

You know that I am absolutely not a fan of this though. Since now we have the "Open Lock" and the "Closed Lock" and both have the same caption "secure". This is just not how toggle buttons work. Because you would have to change the text then, too. And then it will say the opposite of what the user gets when the button is clicked. A toggle button shows a state and that state can be activated. And users are now used to this behavior anyway. Any change will be rather irritating. As a user I would not like either. Added to that are the tecnical risks. It is also illogical, e.g. now if you don't sign but encrypt the lock is closed but not toggled. Or if you only sign the lock is open with a ribbon but not toggled.
As written in the task, if we really wanted to make it clear what happens we should take page out of KMails book and add "This message will be signed / encrypted" somewhere above the text input field. I don't think otherwise it is helped in any way that people accidentally send out unecrypted mails, since the icon can be in the reduced menuband and much smaller or even moved out of the default ribbon bar into a scroll area.

A full bug is that In the message list if you use inline reply it does not work. There the icon is not updated

at all You can remove sign / encrypt and so on. I can make a video if I log into an X11 session, but I think it should be easy to reproduce.

The minature icon

would need to be adapted, too since users can move it using customize menuband and then you need to open and close the lock.