The compliance (audibility, recovery, etc) is the big problem, IMO, not the security.