> even if an attacker has installed malware or has complete physical possession of the PC.

The line between "attacker with physical possession" and "owner" keeps getting blurrier.