Unable to enroll a new device when keys are on a card (gpg vs. gpg2 shell out)

This is related to the issue #2452.
Last tested with keybase 1.0.16.
I have my keys on an OpenPGP card (and I can use them with GnuPG 2).
When run the GUI on a new computer, and select to "log in with passphrase", it offers me to "sign my installation of keybase with GPG", with two options: "export secret keys" which is not only insecure, but technically impossible when they keys are on a card, and "One time shell to GPG". When I do the latter, it gives me "Unknown error: Error: GPG error: exit status 2".

As a separate note, after that situation, run_keybase was unable to kill the running instance and hanged on indefinitely. But I cannot reproduce it anymore.

As a workaround, I created a temporary symlink gpg -> gpg2 in a directory early in my path, and after that enrollment worked.

If I may suggest to introduce a text field in the GUI prefilled with the gpg command, that the user can edit to change the command name and maybe to add options if necessary?

Start by reproducing the GUI enrollment flow with keys on an OpenPGP card and compare the gpg and gpg2 commands it shells out to. Inspect the enrollment path and run_keybase handling; done means card-backed enrollment succeeds without requiring a symlink, and the reported shutdown hang is understood or fixed.