At the end of the day it's an arms race, and you're just trying to slow attackers down.
Security by obscurity tends to refer to measures which can be broken once, and thereafter opened trivially. It sounds like the article is about one of these trivial openings.
Everything can be broken; the goal is to move it or arrest them before they can get in, physically or virtually. It just so happens that, virtually, the time required to brute force it can, at times, be on heat-death-of-the-universe scales. Safes tend to rely on men with guns following soon after alarms trigger.
Input rate limiting + known key size should provide a concrete search space.
What part of the parent are you responding to here?
> Your private keys are just "obscure" information that requires some effort to find too.
I think this is highly misleading. There is nothing "just" or "some" about it. Your private keys are "obscured" information that requires a (mostly) specific and quantifiably very large amount of effort to find, and which if it were to become exposed, can be changed without requiring any new design to restore security.
Blueprints and wiring diagrams are "barely if at all obscured" information that requires vague, hard-to-quantify, and often trivially little amount of effort to find, and if exposed, can't be easily changed without requiring entirely new designs, manufacturing, and engineering.
How do you quantify the probability they have a rootkit for your machine?
That's the point behind rejecting 'security by obscurity', so I can't see any dichotomy between the two.
Replace 'physical' with 'cryptographic' and 'authority response time' with 'reasonable amount of time'. It's literally the same thing.
