Totally. It's not a simple task, and what this post describes creates a threat model that I would generously term "dire."