Instead, it should deploy the public key to DNS, and use that key. THis way, the original organisation key is never used.