At this point, we should start saying "not your keys, not Bitcoin," because you can't prove whether what you own is BTC or just an IOU until it's in your wallet.