Before arguing about anything, first fix your biggest design flaw:
You have full access to the private keys.

Then, please explain how you are able to prevent CSRF with "SQL protection filter".