J Greely: Any program that runs as your user can read ~/.ssh/id_* and send it to whoever. Stealing your private keys doesn't require process inspection.