> Who's going to do that? The point is that if you require more security there are tools to check it. For me I'm comfortable enough that an attack requires phy

> Who's going to do that? The point is that if you require more security there are tools to check it. For me I'm comfortable enough that an attack requires physical access to my keys, so I don't. > Maybe someone will figure it out if they're tracking the numbers written on the outside. So if your opsec requires it keep track of which keys you have and their identities. If one is fried remove it from all the services you authenticate with. I'm not saying its perfect but you can create practices/procedures that protect (or at least let you know it happened) from most realistic attacks.