But I see in http://www.exim.org/exim-html-current/doc/html/spec_html/filter_ch-exim_filter_files.html
$message_body: The initial portion of the body of the message. By default, up to 500 characters are read into this variable, but the system administrator can configure this to some other value. Newlines in the body are converted into single spaces.
$message_body_end: The final portion of the body of the message, formatted and limited in the same way as $message_body.
So I would assume you'd put the begin and end PGP message as those variables for delivery, non-presence for bounce, or just bounce everything by default with those variables as the only exceptions. I wouldn't guess many people would figure out to put those at the beginning and end of every unencrypted message unless you tipped them off in your bounce message or elsewhere, that your filter is looking for them.