barbican is only incubated  and potential graduation is something we should not bank on entirely  i would really like to see a  dumb  key allocator done just in nova for the instances as a fallback  even though it is not secure  it would handle the at rest problem of another user booting their guest and doing strings on  dev sda  to pull out previous user data  this is something which has previously been exploited at amazon  rax  and digitial ocean  so definitely worth protecting against even before barbican becomes a full part of openstack  