OK, the Windows kernel is encrypted, but the same problem applies to TrueCrypt. You need to enter a passphrase / insert a USB stick, and someone could install a modified version of TrueCrypt that saves the key to somewhere (like the last sector of the disk, or NVRAM).