We don't store the password in the DOM. When you choose to sign/encrypt, the password is passed to gpg (via the plugin) and promptly goes out of scope. (It means you have to enter your password every time you want to sign/encrypt, but this seems safer)