I think the systemd case is ok. But PBT_APMSUSPEND is not necessarily. There's a 2 second timeout before Windows suspends or hibernates regardless. It's possib

I think the systemd case is ok. But PBT_APMSUSPEND is not necessarily. There's a 2 second timeout before Windows suspends or hibernates regardless. It's possible for the event handling thread not to run until after the timeout has passed, that is, after the system has returned from suspend or hibernate. That's important considering the adversary might induce this kind of scenario to steal the secret. Kernel mode driver does not have that limitation, because it can't be pre-empted.