Yeah, I guess my comments was assuming the trust was of the type 'trust not to do something nefarious' rather than 'trust not to have a vulnerability'. You make a good point about the latter being a more serious concern in this case.