Correct.

Things might be different when we get delegated signing, but that landscape is not fully hashed out right now IIUC.