Anyone using gpgme will trigger the pinentry program, which you can make recognisable if you need a trusted UI. Or, if paranoid enough, you can store the key o

Anyone using gpgme will trigger the pinentry program, which you can make recognisable if you need a trusted UI. Or, if paranoid enough, you can store the key on a stick (like a cryptostick) - in this case, it doesn't matter what you type in since the key never escapes. Note that this is all while assuming that you do not trust what runs on your computer.