Strongly disagree here:
If you are mitigating physical access, don’t forget to use AEM/Heads with a hardware key…