i don't really need a gpg passphrase (in this specific instance) since i need the system to be able to read its own secrets in an unattended manner. finally found this solution to avoid pinentry entirely: gpg --pinentry-mode=loopback --passphrase "" --gen-key