Union file systems: Implementations, part I

Userspace whiteouts -- what about security? Doesn't that mean (at the very least) that I could see the names of deleted files? Or even maybe be able to open them? That doesn't seem to work -- there are too many things that will assume that once a file is deleted, it's deleted...