Could you elaborate on the separate key per zone issue? It's possible to create different API keys which have only access to a specific zone, and I'm a non-enterprise user.

This allows you to restrict it to a domain (e.g. example.com) but not a sub-domain of that domain.