Why are these going to be government engineers? Remember, nobody but me needs to trust my widget. They just need to trust that my public keys go with private keys which only I know. What the government is trusting to identify me is a mathematical function. The widget is simply a device which calculates this function. My vision is that the widget hardware and firmware are open-source all the way down.

The widget can do exactly three things with a piece of read data:

1. store it as data under a given key
2. encrypt it with a given key and output the result
3. store it as a key

None of these involves code which dispatches on the value of the data. The data buffer is of fixed size. I think that pathway can be made secure fairly easily.