@grondilu: That will mean the keyfile will be available somewhere in the filesystem. We do not want that. The passphrase will be in fact entered by the user through a web interface to decrypt the volume.
Anyway the CPAN guys figured it out. It was a race condition which is solved by a simple "sleep 1" after the $exp->send command.