Maybe that field becomes read-only if the object is persisted and the client does not have the private key? Or is that too strict?