A classic paper. The general struggle in security is getting to a point where you minimize the trust required by your application.