considering putting all client code onto (respective) r/w encrypted disk image. too paranoid?