Seems most of the people responding here didn't bother to read about subliminal channels before giving their 2c of wisdom. 

It looks like covert messages can be embedded in the signature itself.  This would be bad. Real bad. 

My simpleton solution would be to use paper wallets and sign transactions offline with a vetted copy of something like coinb.in where you can review the code line by line to verify that "k" is not being gamed.

Thoughts, smart people?