Or are you asking can a vendor prevent a compromised user account from installing pgp and encrypting everything? Probably not very well.