This makes me wonder if the vector for this exploit is a kernel extension that subverts the keychain service. Except that the kernel loading exploit appears to

This makes me wonder if the vector for this exploit is a kernel extension that subverts the keychain service. Except that the kernel loading exploit appears to require root privileges.