A side note: two-factor authentication (smartcards, etc) -- which minimizes Evil Maid exposure -- is unsupported on the OSX version of PGP Whole Disk Encryption.

Let's pester their support staff to add it.