So, you host a server for them, and then through eval, they "take over" the server? And this key is only accessible to you for a split second or so?
We can do the setkey() through eval, through a site, or the remote console, which is practically eval on the desktop, and we can see the console. Considering that once you set the key, everything reloads. And I could be wrong on this, but I think there's a limit of going up to look at previous code, therefore, yes, probably a split second.