the 'trusted' key is written to disk