ssp oughtn't be able to make arbitrary alterations to the kernel, though. As such it's a lot harder to hide your tracks as ssp than it is as root.