In security contexts, you have to make your claims carefully and explicitly. Assumptions don't play nicely there.

And getting access to private keys can happen by means other than the user volunteering them.