Good point. I had assumed you and Nonentity were talking about the likelihood a leak would happen in the first place, rather than the likelihood of disastrous results if we assume a leak is a fait accompli. Still, if you only have a very small level of very-high level officials who are allowed to access the code, you could at least create a situation where if a leak happened there would be a very small list of suspects, so leakers would be unlikely to do it for financial gain since their finances would immediately be under very high scrutiny, though an ideologue committed to aiding some other country still might do it even knowing they would likely get caught. Also, one could still imagine creative ways of designing the procedure for accessing the key that would make it technically difficult to steal–you might have a group of two or more officials who only get to see parts of key and enter it in sequence, everyone could be recorded while viewing and entering their part of the key, they could be searched for cameras and then have to wear something akin to hazmat suit that would block any hidden cameras on their body that had gone undetected, etc.
Of course, the more convoluted the plan for an ideal scheme becomes, the less likely it is that the real-world government is going to implement anything that effective. But I still think it’s worth trying to creatively come up with a hypothetical scheme, both because of the slight possibility that some future administration might take privacy concerns seriously enough to put it into practices, but also just for rhetorical purposes. For one, when an official like Obama says there has to be some middle ground between guaranteeing privacy and some sort of access to suspects’ computers, proposing some complicated scheme for security puts the ball back in the officials’ court rather than allowing them to paint those who scoff at the idea of “middle ground” as absolutists are ideologues. Also, pointing out how complicated a scheme would need to be to really minimize the probability of a disastrous leak helps emphasize all the possible failure points that a more half-assed scheme would have.
