Thanks for pointing that out. I'm happy with a software kill switch, as long as it's provably isolated from the rest of the system.

The nub of the idea is a legal requirement for a physical switch that will in all cases immediately disconnect the device from the network.