Regardless of the final conclusions, I much prefer a security model that is predicated on me keeping a secret than relying on someone else’s promise that they implemented the proper security controls.