I think we do need the key (https://developer.chrome.com/extensions/app_identity#copy_key) so that the auth-scopes can be linked to an chrome-app, and that chome-app is authorized by the dev-console.