one hand, users cannot trust their devices and nevertheless want to be able to do secure