You absolutely can do secure attention key with just another program. If your account does not have /dev/input permissions, only your display server has keyboar

You absolutely can do secure attention key with just another program. If your account does not have /dev/input permissions, only your display server has keyboard access (unless you run stuff as root lol), and handle key combos that force some secure thing to happen.