Uh, I know. My point is that you won't always know all the security vectors you have to deal with. There's no way of just asserting that your model is free of side-channel attacks without (minimally) intimate knowledge of the hardware it's going to run on.