Yes, their way of implementing api keys seems rather odd. I can see that it could possibly work if implemented within a closed-source mobile app using end-to-end HTTPS encryption, but for any website, their solution is flawed.
I will just select another tile layer for the time being. Thanks for the answer :)