My solution (explained above) together with what Samuel says makes it pretty safe though. And digital signing of programs is something everybody should do for any sensitive environment.