[vgatherps]

The content server probably wouldn't be useful for getting the keys, unless they have some insane wallet manager.

My best guess is simple key exfiltration?