CZ says private keys must never leave hardware wallets.