Yes exactly, keys are only injected at host boundary