This might seem unusual, but having thought about this a lot, I think the issue was with naming PKI concepts. Calling the public part of the keypair a 'public key' has conditioned people that 'uploading a key' is a normal thing to do. Once 'uploading keys' is normal, it's not a huge step for a user who doesn't know PKI well to go from uploading their public key to uploading their private key.