But not listening on port 80 will also usually break the application. Though I suppose the same API key may be used by multiple applications, or multiple copie

But not listening on port 80 will also usually break the application. Though I suppose the same API key may be used by multiple applications, or multiple copies of an application configured differently. edit: and even if there's only one application, yet for whatever reason it doesn't get taken down despite being broken, revoking the key now still prevents against a MITM later.