They still need to see your query and will always know which events to send back. From those things, it's very easy to figure out which key you are using.