Yah there's no way to verify they can't access your key (even if you don't opt-in to the service) because their code is closed source