it cannot email your secret key to an attacker because of prompt injection etc.