For the bottom-up approach described in #250 , it's helpful to ensure that only the "lowest-level" types that are secret have ZeroizeOnDrop applied to them. Review the list of types that have this annotation. For any compound types (e.g. structs) whose fields are all private (or a mix of private and public with public ones flagged), remove the ZeroizeOnDrop derivation.