I guess encrypted swap would be a good option (easier than messing with mlock()) According to the docs, this is enabled by default.