How do I know your company doesn’t have evil intentions, and store a copy of all private keys?