I took Jamie's advice and simplified the openssl based tests to ignore the actual output. I added a test to generate a signed+encrypted message, and verified that with openssl (in two steps). I'm a bit stumped why the test introduced in patch 5/5 is failing so badly. I'd give even odds that I haven't set up gpgsm right (only imported the public key and not the private one?). Still, it looks to me like there should be some more diagnostics from notmuch if the crypto is failing.