Like I said, I am not arguing that Google did right. I'm just saying, if you're handing out a single key to people with arbitrary configurations you should probably assume it's compromised. Your friends could just as well have had some other malware.