You're quite right.

What makes perl great is that the programmer doesn't have to worry about all the housekeeping behind the scenes like memory management. But there are some situations - and this is one of them - where you want to do memory management yourself. In this case, you want to ensure that that area of your process's memory is kept *in memory* and not written to the swap partition. You then want to zero it yourself before de-allocating it. None of which you can do in perl.

This is discussed further in the gnupg manual here.

Apparently the current implementation of perl will at least overwrite your string values in memory if you have your password in a scalar and then allocate another string value of exactly the same length to that scalar. However, this behaviour is not guaranteed in future versions. The plain-text password may have also been assigned to other temporary C variables by perl and still be hanging around in memory, and so on, so it's still not safe.

Basically, if you really need to be this paranoid, don't use perl.