[karlgkk]

> If the kernel had to be reauthenticated periodically (think oauth's refresh token)

If the kernel is compromised, this is pointless I think. You could just "fake it".

SEP is already very active in filesystem encryption. The real important thing is evicting all sensitive information from memory. Reboot is the simplest and most effective, and the end result is the same.

[grahamj]

It’s involved in handling the keys but I don’t think disk is processed by the SEP. If it was the SEP could simply stop providing access.