They could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone looking at the network tab, which is the real issue being pointed out.