The difference between gpg1 and gpg2 that I was noticing arises from the fact that gpg2 uses an external cryptographic library, libgcrypt, whereas gpg1 uses an integrated cryptographic library.
And specifically, Homebrew updated to version 1.7.4 of libgcrypt on December 10, which introduced a regression in the libgcrypt code, leading to the insecure memory ...
I'm seeing exactly the same problem and, according to a MacPorts bug report, it's coming from libgpg-error and not seen with GnuPG version 2.1.16.
So it seems we need to either wait for the gnupg21 port to move from 2.1.15 to 2.1.16 or locally modify and rebuild the gnupg21 port (and maybe some of its dependencies?) to upgrade ahead of the official update. ...
Try to uncheck Store passphrases in OS X Keychain by default and press Delete stored passphrases button in GPGPreferences if you installed GPG Suite.
Also try to comment this line from your ~/.gnupg/gpg.conf:
I'm experimenting with veertu to run a 10.11 VM inside 10.12 native for cases like this. It's clearly not ideal, but depending on how large your mailboxes are - it might let you keep working with encrypted emails while that specific tool gets reworked (assuming it does get ported).