This really is the least problem. As long as the key export API isn't actually gated (e.g. by only working over a backend-to-backend API with a mandatory "secu

This really is the least problem. As long as the key export API isn't actually gated (e.g. by only working over a backend-to-backend API with a mandatory "security audit" to gain access, by wrapping exported keys using vendor-specific keys and requiring a similar audit to be included as an export target etc.), everything else can be figured out. There's only so many ways you can encode an ECDSA key.