He might&#x27;ve just got hashes from those private keys, for proof. It&#x27;s not clear if he actually took all these keys. To me this would seem like a responsible, easy and realistic way of proving you could&#x27;ve taken the keys if you were malicious.<p>The whole point is kinda moot, seeing how they did not have proper auditing and can&#x27;t know if the keys were taken either way.