That is exactly that kind of thing that needs to be in a contract. When someone inevitably shares private keys and it results in some kind of financial loss ... who is responsible for the damages? Contracts codify the liability if it isn't otherwise defined by statute.