No, private keys don’t leave user’s devices. This is the case in all such products. But with a malicious update, they could ship them to their infra, targeting

No, private keys don’t leave user’s devices. This is the case in all such products. But with a malicious update, they could ship them to their infra, targeting some users. The product then becomes malware!