Why would a bad actor volunteer to run a "declarative workflow running in sealed compute environment" when they could just not do that?