[tptacek]

What difference does this make? In your threat model the only serious countermeasure between you and state-level adversaries is a Logstash implementation?