I guess I'm paranoid, too. I've even been pondering to setup ~/pocket-dimension as a small ramdisk. If I store production keys or certificates on my usual ext4

I guess I'm paranoid, too. I've even been pondering to setup ~/pocket-dimension as a small ramdisk. If I store production keys or certificates on my usual ext4 filesystem, all changes are written to the ext4 journal. Thus deleting the files technically isn't enough - even with shred. A ramdisk would avoid this issue and would automatically wipe itself on shutdown.