[ggm]

Private key should be in the trust region and set up when you make the account

[harvey9]

I took the gpp to mean the publisher had leaked their private key by putting it in the app code when it should never have left their servers.

[ggm]

Also possible. Enough private keys in git repo to make this believable.