The messages relating to /var/root/.gnupg appear to be coming from gpg which gets launched to perform signature verification duties, rather than from CPAN.pm itself. And you shouldn’t get them again, either.

Makeshifts last the longest.