content: Eh, I would go more with the yes and yes. They don't need to send the keys to their server, just modify the code that generates the key in predictable ways so they can generate a copy themselves. Client side or not they are the ones sending the code in the first place.