If the device is rooted can't the malicious app also get the encryption key?