That's a given I think. If you can't trust the OS then you can't trust the client.