A much more realistic scenario is RAM being swapped to disk.

Either way, `memzero` is what libsodium recommends to securely wipe memory. I think ocaml-sodium should fully follow best practices of libsodium rather than invent its own. Perhaps it is worth opening a libsodium issue, if you think these attacks are important.