Comment by cf_

Well, depending on legislation, they could be ordered to change the code to send the user password to them on next login for that account and then decrypt everything…