also, the app has the damn secret in its control, do you want to make it impossible to present users private messages in your app because of this?

then who gets to say which app can do this?

it's a deadlock, you have to have all, or none, stop bullshitting