Well, that’s one way to kill your credibility quickly. Even if it was innocent, they should have anticipated that someone would have found this and inferred otherwise, and preemptively disclosed it.

This is public key encryption software, not a toy. Don’t act confused when your users pick everything apart.