There was no ability to tell who'd even seen the key. A colleague of mine 'got it', and when it was shown he had it, there was a "WTF? You're not supposed to

There was no ability to tell who'd even seen the key. A colleague of mine 'got it', and when it was shown he had it, there was a "WTF? You're not supposed to have that? Where'd you get it?". It was checked in to version control. It was just in a project that only a few people were assigned to, but there was no restriction on who could view those projects.