I've had my security team ask for this sort of thing before. I laughed at them and didn't send it because I understand the way this works, but they didn't and were following their new vendor requirements process. Get a swe in the middle who doesn't and voila