My comment still applies regardless of any level of “explaining” [1]:

1. Either Nord/Teso are loose with keys (horrible)

Or

2. Proton isn’t being truthful.

I don’t think it’s a conspiracy or anything that it is Tesonet/Nord. Rather, the problem is you cannot trust someone with your privacy if they can’t even manage their own keys.

[1] The explanation is poor at best and doesn’t explain why they worked so hard to try to delete all of the evidence (all of which was archived already). Additionally, nothing can explain away the lack of security with key management across these two orgs.