Facilitate direct import to gpg with password protection

I'm not at all sure if this is something that even makes sense to do, or if this is something that can already be done and I just don't know what I'm doing (such is the nature with a lot of open source security tools like gpg ... so difficult to use in a secure manner that most people just use them in a dangerous manner).

I've followed a few scripts out on the web for importing keybase keys into gpg for signing commits in git as well as a really nice one for converting the key for use with ssh. I have yet to see a script that exports the key from keybase, imports it into gpg and prompts for a password to protect the private key with, so I decided to write one, myself.

I got stuck in one spot. I can get gpg to password protect the key, but only after it has imported it into gpg, which means it exists on disk in an unprotected form for a brief period of time (or a really long period of time if gpg-agent is configured to use X to prompt and one runs the script from SSH, where it hangs waiting for the gpg-agent prompt to be acknowledged). Depending on filesystems or devices as well as backup software that backs up "on write", this in-the-clear key could become recoverable in an unprotected form.

I've searched for a way to force prompting on import and the only thing I've been able to find is this, which implies that gpg will prompt for a password when it encounters a key that is locked (and there's no real explanation as to what that means -- is it prompting for a password to unlock it and then storing it in the clear or is it prompting for a password to protect it ... or both?). So the question becomes, could keybase provide a key in a format that would force gpg to prompt for a password and store that key in encrypted form from the beginning, or could keybase be changed to add the ability to export a key directly to the gpg version 2 keystore?

Having an export option would also make it easier to use your keybase key for signing commits in git (it's a really cool capability that keybase enables). It would also allow creating an authorization subkey/exporting it as an SSH key in a protected manner more secure.

I realize that a bit of this is on gpg and not on you fine folks, and its entirely possible I've missed an important command-line option in gpg that's already there (there's only a few hundred of them), but thought I'd start here. :)

The issue names no repository files or tests; start by checking the requested Keybase-to-GPG export path and GPG's import and password-protection behavior. Define whether secure direct export is feasible, then document and test a design that avoids an on-disk unprotected private key and supports the stated Git and SSH uses.