even better - as far as I am aware the client isn't open (and even if it were, is your installed build from the same source?).

so, even if the keys are local only, who says there isn't a hidden API that simply sends locally decrypted content back to a remotely calling endpoint?