What they're _planning_ is not relevant. What matters is whether they're competent enough to keep such keys secure. (Such as by not allowing malicious actors to get copies of them.)

What is relevant is that they are demonstrably _not_ competent.