Usage based billing - API key usage for localhost clients

[Blackbaud-NickGlyder]

Documentation/Product Version
TinyMCE 6.8.3 - TinyMCE 7

Related page URL (if applicable)
https://www.tiny.cloud/docs/tinymce/latest/usage-based-billing/
https://www.tiny.cloud/blog/this-domain-is-not-registered-with-tiny-cloud/

I would like to know...
With the announcement of UBB and changes to the core plan, how do editor loads against localhost count towards usage?

Since the API key is not strictly secret (included in the URL to request CDN resources), what prevents a malicious actor from running up editor loads by scraping the API key and continuously loading the editor?

Relatedly:

1. It appears localhost cannot be removed as a valid domain from the account dashboard.
2. The API key cannot be regenerated or revoked

#2 is particularly painful when trying to move from a Tiny Cloud implementation to a a self-hosted implementation.