I think you are headed in the right direction wrt a capability system, however, they are predicated on tamper proof hardware. Since you stipulate human being copying and torturing (sounds like tampering to me), I think this is not ultimate privacy. Hmm, perhaps you should set up a key escrow system (!) so that you need to call your most trusted friends to assemble your session key. The session key works only once, assuming a tamper proof, capability system. When you call them, they can quiz you on your mental and physical health to determine whether they should give you the keys...thus limiting the ability of a torturer. Paul E. Baclace peb@procase.com