I'm surprised nobody in the thread mentioned using a TPM device when available. My 5-year old MB comes with one builtin, and probably all new ones have one. TPM also provides a limited amount of persistent storage.