I'd always thought that if all entries tagged with tag A were locked then the security of the tag overall would be locked, and nobody not trusted would even see the tag.

It is, I am being unclear. The problem I am seeing is that if a tag is on a public post and someone subscribes to it and then later the entry security gets changed - would the subscription just be deleted? What if the person then posts another public entry with that tag? It just sounds messy to me, as there is no offical "this tag is private" setting.