I think that concern is quite valid. But it's a choice I guess. I for one would not choose that option for exactly the argument you provide. The damage caused

I think that concern is quite valid. But it's a choice I guess. I for one would not choose that option for exactly the argument you provide. The damage caused by having your resource become unusable I think in most or a lot of cases is greater than the damage caused by a key compromise. The first damage is absolute. It will happen if you don't recover in time. The second type of damage is hyperthetical somewhat. But okay, I expect that there are some use cases where the second sort of damage is more of a concern.