Apart from the fact you'd better not deploy custom crypto code anyway, you're reinventing the wheel. OpenPGP's string-to-key functionality is configurable and can be adjusted to your needs, while not losing compatiblity. I'm not discussing your choices in the number of cycles here, although they seem a little bit harsh. I'd recommend reading At what point does adding more iterations to PBKDF2 provide no extra security? on this topic.
Use name as the cipher algorithm for symmetric encryption with a passphrase if
--cipher-algo are not given. The default is AES-128.
Use name as the digest algorithm used to mangle the passphrases for symmetric encryption. The default is SHA-1.
Selects how passphrases for symmetric encryption are mangled. If n is 0 a plain passphrase (which is in general not recommended) will be used, a 1 adds a salt (which
should not be used) to the passphrase and a 3 (the default) iterates the whole process a number of times (see
Specify how many times the passphrases mangling for symmetric encryption is repeated. This value may range between 1024 and 65011712 inclusive. The default is inquired
from gpg-agent. Note that not all values in the 1024-65011712 range are legal and if an illegal value is selected, GnuPG will round up to the nearest legal value. This
option is only meaningful if
--s2k-mode is set to the default of 3.
To wrap up, following options will have the same effect:
gpg --s2k-mode 3 --s2k-digest-algo SHA512 --s2k-count 10000000 --symmetric
--s2k-mode 3 is GnuPG's default (and only reasonable setting for this option); I did not include
--s2k-cipher-algo as this is not relevant for key derivation (and not handled by the "pre-derivation" you described, anyway). Alternatively, you can set this as default in your
Those options can not only be used for symmetric encryption of messages/files, but are also used for passphrase protection of private keys.