[DennisP]

If you allow external control, there's also risk of an external hack. It might work out if external control is only possible after the button is pushed; that would still allow for a hack coordinated with onboard attackers, but maybe that's giving terrorists too much credit.

But I'd be happy relying on the steep odds against hardware failure happening on the same flight as human attack, as long as we can keep those variables reasonably independent.