Would you entrust credentials to financial auditing software that only ran locally on a trusted client device, where the auditing software was firewalled so it could only access whitelisted network addresses?