how is an Apple service provider able to bypass this? if they can, so can an adversary, no?