If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.