Fair enough if they're doing that. My point isn't so much about who is storing the shared secret, but that someone else must be storing the shared secret. This

Fair enough if they're doing that. My point isn't so much about who is storing the shared secret, but that someone else must be storing the shared secret. This is a fundamental issue with any shared secret -based cryptosystem.