Might I suggest a library that doesn't call out to system binaries and wouldn't be subject to shell injection by design? https://github.com/SecurityInnovation/PGPy