Could you allow GnuPG 1.4.6-2 into etch? DSA 1266-1 was published 10 days ago & the packages has not migrated. http://packages.qa.debian.org/g/gnupg.html indicates to contact debian-release if an update is needed.