Notice how they haven't done that though. It would be trivial to do. Just change all of the private keys to ones supplied by the clients. But they haven't do

Notice how they haven't done that though. It would be trivial to do. Just change all of the private keys to ones supplied by the clients. But they haven't done that. Why would you expect them to do that when they are taking steps away from individual privacy? Leaving a hypothetical option on the table that costs them nothing to do means they actively do not want to do it. So why would they do it?