OK I eventually worked around this problem by adding the secure tag at
the point the message is being sent. The code now looks something like this:

(add-hook 'message-setup-hook
          (lambda ()
            (gnus-alias-determine-identity)
            (define-key message-mode-map (kbd "C-c f")
              'gnus-alias-select-identity)
            (flyspell-mode)))
(add-hook 'message-send-hook 'mml-secure-message-sign-pgpmime)