He might've just got hashes from those private keys, for proof. It's not clear if he actually took all these keys. To me this would seem like a responsible, eas

He might've just got hashes from those private keys, for proof. It's not clear if he actually took all these keys. To me this would seem like a responsible, easy and realistic way of proving you could've taken the keys if you were malicious. The whole point is kinda moot, seeing how they did not have proper auditing and can't know if the keys were taken either way.