Matthew Garrett

I think that would be the ideal situation in a single user setup, yes. We've actually been discussing this recently - there's a strong argument in favour of simply dropping someone into the session with a locked screen for equivalent security. The main problem is that the session keyring is encrypted and is typically unlocked using the user password, so you still need somebody to do that - and certain user session apps assume that the keyring is unlocked and will pop up authentication windows if it isn't. So there's some work to do, but you're right that it'd be a wonderful future.