It says it encrypts the SPI flash with a PIN provided over USB on every boot...but if you can trust the host to store/handle the PIN, why can't the host do the rest of the cryptography too?