V9.14.022.2026.06.11: enforce secret and cleanup safeguards

lib/lib_gnupg.sh

@@ -41,6 +41,12 @@ init_gnupg() {
 
   if [[ "${VAR_SIGNER}" == "true" ]]; then
 
+    validate_secret_file_in_root "${VAR_SIGNING_KEY}" "signing key file" || return "${ERR_SECRET_PATH}"
+    validate_secret_file_in_root "${VAR_SIGNING_KEY_PASS}" "signing passphrase file" || return "${ERR_SECRET_PATH}"
+    if [[ -n "${VAR_SIGNING_CA}" ]]; then
+      validate_secret_file_in_root "${VAR_SIGNING_CA}" "signing CA file" || return "${ERR_SECRET_PATH}"
+    fi
+
     __umask=$(umask)
     umask 0077
 
@@ -82,6 +88,7 @@ EOF
 
     declare __pw=""
     __pw="$(<"${VAR_SIGNING_KEY_PASSFILE}")"; __pw="${__pw%$'\r'}"; printf '%s' "${__pw}" >| "${VAR_SIGNING_KEY_PASSFILE}"
+    register_secret_value "${__pw}"
     __pw="" && unset __pw
 
     ### Turn on tracing again ----------------------------------------------------------------------------------------------------