They can easily force updates that exfiltrate keys. You have no choice but to use a recent version of the only client and you have no good way of verifying that

They can easily force updates that exfiltrate keys. You have no choice but to use a recent version of the only client and you have no good way of verifying that the it was built from what's on github.