I could see supporting two matches - one that matches the coursekey, and one that matches an org. Although I don't think I'm fully clear on why we'd whitelist a whole org as opposed to just the courses that needed to be.