Comment by atonse

If someone has control of the application, aren't all bets off at that point?

At some point, your application has to decrypt the data to work with it. The person with control of the application would exfiltrate data that way.