keychain only helps while the key is sitting still. like a stolen laptop, copied home directory, or a backup someone restores. it does nothing about bad code in the process that already unlocked the key. that's why the key should live in its own process, not the one decoding public pictures or JSONs.