“Will the user hit ^D in time?” is some kind of movie-inspired imitation of security. If I can't trust that computer while I'm not logged in, I shouldn't trust

“Will the user hit ^D in time?” is some kind of movie-inspired imitation of security. If I can't trust that computer while I'm not logged in, I shouldn't trust it any more when I am. Encryption keys should be opaquely held by processes as capability tokens.