The attack can only succeed when victim's gpg is run with 'verbose' option turned on. Which is rather unusual situation.