I think the real answer to this sort of problem would be to set up a unit test that involves making a full memory dump and scanning it for private key material.

I think the real answer to this sort of problem would be to set up a unit test that involves making a full memory dump and scanning it for private key material. The traps here are just too subtle to try to catch all the failure-to-zero bugs in any other way.