Thanks. An answer can be pieced together then:
- mainmem.useNamedFile = "false"
- suspend.disabled = "true"
- ClearPageFileAtShutdown to 1 to erase pagefile at shutdown
- Pagefile to start from 16 MB and grow, so it is erased fast
- Truecrypt full-disk encryption in the VM, with the default bios and not uefi because truecrypt does not support uefi
- Optional: non-persistent VM disk, if VM needs internet access
- Optional: drive vaccine in the host for non-persistency of system partition, if host needs internet access
Hope there aren't any holes in vmware-created files in the .vmx folder.