pKVM isolation for sensitive operations