Re X being insecure. Yep. People have brought this up in the comments of the blog post. It doesn't reduce security by shifting it to a different user, and no, i

Re X being insecure. Yep. People have brought this up in the comments of the blog post. It doesn't reduce security by shifting it to a different user, and no, it's not as good as running under a VM. However it does give it some extra protection. For example it would have protected your main users ~/.ssh/ and ~/.gnupg/ directories etc that this latest pdf.js vulnerability could have exposed. Re the TPM, even in the worse case scenario where the TPM is totally evil, it can't reduce the randomness on my system. It will either keep it the same or improve it. At least on Linux, where it is just one extra source of entropy on top of the other existing ones. Re the smart card, that may be the case, but it's probably the safest one out there, recommended and pushed by the guy who wrote GnuPG. It's worth noting that the blog post is 4 years old now.