This is called "security through compartmentalization", i.e., you don't trust one single entity. The only approach that works.