The way it's supposed to work, and I guess does work today otherwise we'd have heard about it, is that your passphrase doesn't actually get sent anywhere. Inste

The way it's supposed to work, and I guess does work today otherwise we'd have heard about it, is that your passphrase doesn't actually get sent anywhere. Instead, it all happens client-side. So today they don't have your keys. Not to say they couldn't be malicious in the future, or get hacked, but that's not the case today. Again, as far as I know.