On #2, if you were Ministry of State Security, you could also use 0-day code execution to gain the same data the Apple process retrieves. I guess existence-of-

On #2, if you were Ministry of State Security, you could also use 0-day code execution to gain the same data the Apple process retrieves. I guess existence-of-0-days is pretty reasonable, but I'd rather build the repeatable physical attack, as I could then pull a lot more than just Dkey, and do it forever. (I'm more interested in the "built an enterprise-root-of-trust mobile platform", but "build an awesome, repeatable attack against everything" is also pretty tempting, if only to sell the former.)