Correct. The use of the main key as receiver makes it country party trustless. If the receive uses a separate key to receive, he just needs to leak that key to expose the sender.