It depends on the security of supplier X's private keys. I think there's a general conflation of the security of the cryptography with the security of the system overall.