I saw once a support person from $COMPANY_I_WORK_IN ask a client to send their private key in email, so they could troubleshoot something. I pressed "Reply all" and called it out, and was yelled at later.