> However, you do lose deniability -- if you have possession of that key, you have to explain it.
Full disk encryption + encrypted VMs that are powered down when not in use + religious adherence to TOR and basic OpSec common sense -> deniability is almost irrelevant