Selling vendor accounts is permitted, so it's not something we're trying to stop at this point in time, but it should reiterate the importance of - as you said - not finalizing early AND always using PGP.