Either. Go ahead and do it in userland, if you want to be paranoid. I know I'd prefer to do things in paranoia as a matter of my own policy anyway.