> That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assu

> That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption. It's absolutely unreasonable. If my endpoint is compromised, should I assume my key is potentially violated, and so change it? Yes But should I assume that everything in my life is tainted and therefore pre-emptively expose all my secrets to attackers immediately? Of course not.