How would a blackhat grab the wallet if it's GPG encrypted and needs the passphrase from the dev?