We all (who have tech skills) are at least a little bit at fault. We never developed some kind of norm of: how can you assure your users that their private keys are 'proper'? Were they supposed to l...