They could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone look

They could also just upload the password and the key material, so in the end this is about them being able to do it in a way that isn't obvious to everyone looking at the network tab, which is the real issue being pointed out.