The malware cannot overwrite the public key. The rest is, like I said, not the attack that we're trying to prevent here. Being able to run code in the kernel means that you can alter kernel state. That's why we're focusing on making it difficult to run code in the kernel.