Pretty much all of security relies on the user not giving out their passwords or secret keys. Imho it's an implicit assumption when talking about identity and security. If we break that assumption, nothing in the world is secure, and any discussion about security becomes pointless.

In security contexts, you have to make your claims carefully and explicitly. Assumptions don't play nicely there.

And getting access to private keys can happen by means other than the user volunteering them.