Raw multi-line armored key piped through 'echo | gpg --import' came out CRC-corrupted (Invalid keyring) on the first real run -- something in the secret/env round-trip mangles embedded newlines. Regenerated the bot key (old one is unrecoverable, secrets are write-only) and store it base64-encoded, decoded with base64 -d before import.