This is probably a naive solution..

What is to stop creating a statically linked build of GPG, create a new user account, chmod 0700 the new uid's homedir, copy the new binary into the private user account, and perform all your encryption work in there.

So long as you're not running on a VM using tech like kernel samepage merging, pages from the binary should never be shared