pass clients can totally be backdoored. They decrypt the secret to plain text and add it to your clipboard or whatever... could easily shuttle it off somewhere else at that point.