You can use a hardware module with securely stored key to do that for you. If the whole machine is owned, then I guess it would possible to set limits on these

You can use a hardware module with securely stored key to do that for you. If the whole machine is owned, then I guess it would possible to set limits on these operations. Or at least it can trigger an early warning.