> if a process were to expose a mechanism for other processes to essentially proxy keychain queries through it, that can undermine the security of the whole system.

This looks like a case of confused deputy problem: https://en.wikipedia.org/wiki/Confused_deputy_problem

A capability-based design should be able to systematically prevent this kind of problems.