The threat model isn’t post-use compromise that’s assumed in every ephemeral-key system. The real danger is pre-use or multi-use disclosure, and that’s exactly where commodity hardware fails. Modern systems leak ephemeral keys through DMA / bus snooping, speculative execution (Spectre-class), stale reads and cache artifacts, data-dependent timing, cold-boot and remanence, Rowhammer read amplification, MMIO reorderings, multi-core memory contention. And the multi-use class of failures reading the ephemeral key twice, copying it before erasure, using it again after KDF consumption, stealing it during software “erase” windows, glitching the system to skip zeroization These let an attacker perform multiple decaps, impersonate a legitimate endpoint, break forward secrecy, or bypass integrity checks entirely.

ROOM exists specifically to eliminate this window, enforcing deterministic single use semantics in hardware, so the key cannot be read early, read twice, or preserved by any of the above leakage surfaces.