I think their point was that you don't control your device. If Apple did push code to your device to steal the key, how would you be able to tell?