why not simply put the keys on the 'do-not-pass'-list?