Their main purpose is resistance to insider threats in an environment with lots of other controls. Otherwise, it's really really hard to trust that a sysadmin

Their main purpose is resistance to insider threats in an environment with lots of other controls. Otherwise, it's really really hard to trust that a sysadmin hasn't copied a key (voluntarily or while compelled).