As with many community ran projects based around a commercial vendor, fear of being DMCA'd out of existence is real. We can safely assume they want to be left a

As with many community ran projects based around a commercial vendor, fear of being DMCA'd out of existence is real. We can safely assume they want to be left alone by Canon and not posting the encryption key not only shows they mean no harm to Canon, it also could be argued in court that they are not violating the DMCA (despite the fact they had to obtain the key somehow, at least they can claim ignorance as to how their firmware was magically encrypted/signed - yes it's weak but its something).