[aruss]

iO doesn't guarantee that the adversary can't figure out what "key" is. It turns out that this is possible, but it requires some very careful applications of a special kind of pseudorandom generator.