How so? From what I understand, all requests have to be proxied through OneCLI so that agent can't see your keys.