Look into what the payment industry is doing. They have been, for decades now, putting devices that process payments into physical control of untrusted users. And it works.