there is a pretty big difference between having to hack a local key for every user and a real data breach