As I said, offering both is the ideal. I'd rather have some false positives if it means a way forward without kernel rootkits becoming the new normal.