> I think asserting that it adds meaningful security in the absence of some other mechanism for gaining trust in the kernel is misleading
Do you think it's possible to do security at all without being educated? You seem to be advocating "doing the right thing" for the user, but if the user doesn't know how to do the right thing himself then any hope of security is out of the window anyway.
A perfectly informed user will never run an application that will modify their SSH configuration, so by that argument there's no need to prevent arbitrary user access to that file. We do our best to protect users without getting in their way because it's impossible to expect everybody to do everything right all the time.
Nitpick - a perfectly informed user can certainly run an application (such as a browser) that gets exploited by some external input to attempt to modify their SSH configuration.
A perfectly informed user would never have navigated to a site that was running malicious code. That's basically the point - the threat model today is sufficiently complicated that there's no such thing as a perfectly informed user, so we have to design systems to be resilient against users making mistakes.
Well… it's certainly much more practical to decide "I'll only run applications I trust" than "I'll only ever visit websites I trust" or, in full generality, "I'll only ever use any application to process data whose creator I trust".
But I guess that's not really the point you're making, and of course, in an ideal world native apps would be no more dangerous than websites anyway…
Do you think it's possible to do security at all without being educated? You seem to be advocating "doing the right thing" for the user, but if the user doesn't know how to do the right thing himself then any hope of security is out of the window anyway.