See above for partial prevention. The attacker could steal the creator's computer to get at the key and perhaps read the password from a distance with a telescope or EM sensing equipment to capture the creator's keystrokes. Sensible precautions against placing either the password or the secret key in a vulnerable location will defeat this type of attack. Of course, sensible precautions vary with the level of security. This is highly unlikely with RSA in the near future, but it cannot be ruled out.
Attackers are infinitely devious, while the software author is as a rule only finitely so.
Infinite protection requires infinite code, infinite time, and infinite luck. The requisite algorithms for implementing this system are licensed by various companies. This makes advisable the use of the whole-archive signature method described above for protecting the verification line rather than any attempt to encrypt that line. With the advent of public key digital signatures, this problem may at last be solved. While protection against the worst case, whole-file spoofing with a stolen key, is less effective, it does not demonstrate a loss of security versus previous methods.