Geoff, I'm sure you don't think you're dodging the issue, but reading the contents of the .ssh directory is useless without also intercepting my passphrases, which you'd need a keylogger for (or a malicious program that uses the same hook Instant Hijack does...). Yes, some people's passphrases can be brute-forced, but that's an unrelated problem.

You're right in one respect, though: if I discovered that an application was poking around in .ssh, it would also go onto the banned list, and I'd force everyone who ran it to create new keys after it was scrubbed from their machines.

-j