It’s possible but I haven’t felt the need, and it’s another thing that can go wrong. If I think my key may have been compromised I have much bigger problems. I should assume my whole machine is pwned and trojan’d, so I should replace the disk and reinstall everything.

I can see some benefit in using a special token to hold the key instead of just generating it on my laptop. One of these days.