Blockstream runs many nodes, with no control on any of the funds of the user, nor of his keys:

It's a VLS signer on the user side that talks to hsmd through a proxy to use the node.