OS X has a setting called "destroy FileVault key on standby" in `pmset` which mitigates cold boot attacks.

I kinda want the CPU/MMU to support loading encryption keys to transparently encrypt some or all of RAM (could also toss in error checking while we're at it). SGX has this in the trusted containers, but I think it makes sense for general use too.