&gt; Allowing the user to lock out that second key doesn&#x27;t fix anything because 99.99% of users will never do that, or even know it exists.<p>That&#x27;s easily solved: On initial device setup, the user could be asked to explicitly disable the key by asking something like &quot;Would you like to secure your device by permanently disallowing the installation of untrusted software? Y&#x2F;N&quot;<p>Also, as someone else clarified below, the alternate key I was proposing is <i>unique to the device</i>.  So any attack against you would have to be tailored to your device.  That leaves the main threats as: 1) an NSA-like shipment-interception and 2) someone getting access to your user key after the device is in your possession.  1) can be mitigated by buying your device in a random retail shop, and 2) can be prevented by immediately permanently clearing the user the key.