The untrusted OS could ransomware encrypt the already-encrypted trusted one. The attacker is denied access to my SSH keys, but so am I.

Fully willing to confess this feels an outsized threat model, but it is something. Going forward, this separation will allow me to undersize my next linux workstation which requires far more modest hardware if never running games.