It doesn't even matter to me whether a protocol is exploitable or not, the second it fails to manage keys this way, I will never recommend it.Do not pass go.Do not collect $200.