They still need to see your query and will always know which events to send back. From those things, it's very easy to figure out which key you are using.
Discussion
Makes sense. Would it be technically possible for a more privacy-focused client to seed queries with a few random requests? For example, add a few random npubs to a follow list query. The client then discards the random data received before serving the followed feed to the user. This might be analogues to padding techniques used in VPN protocols to evade DPI.
Only if we find a way to encode the filter amin some homomorphic encryption... 🤔