Don't keep your security keys capable of root access on anything that's not a hardware token locked in a safe.

Of course if you can access the software running the blockchain and get everyone to install an update, that works too

You can call your colleague on the phone to confirm they sent the email asking you to open an attachment.