To work as we'd expect, this secure_file_delete needs to be done on two areas of disk - the location where we originally wrote the file and also the location that the editor re-wrote the file.  This might be the same, but if the editor wrote to a temp file and then moves it as some do it will be two separate files. I had attempted to deal with this previously by keeping hold of the filehandle for the decrypted file (i.e. the open file object, not just the path).

All bets are of course off if using ext4 which does balanced writes across disk anyway (or SSDs, some of which do something similar internally), so this is only ever best effort.