Technically the key should never leave the web UI (and be discarded once you close the page); but since they control the domain & what they serve, they could se

Technically the key should never leave the web UI (and be discarded once you close the page); but since they control the domain & what they serve, they could serve a malicious version of it that silently exfiltrates that key back to them which they can use later on even after you close the page.