Turn off command-echoing just before invoking subshell, then turn it back on if VERBOSE=yes afterward.
# for which the user has no access at all.