Given that the keys can trickle down to tenant admins (https://github.com/sakaiproject/Hilary/issues/331) I'm going to implement @mrvisser's suggestion so this work can move forward