The inability to restrict key permissions to a domain is problematic.

The truth is that this is a security issue because every "developer" key is also a production key.

If you provided a sandbox option or a test account, that would be OK - but in this setup where the test domain for dev is on the production account, it makes no sense.