a) some WKD do not have proper CORS headers, so they fail to be fetched
b) directly fetching the key reveals the users IP, this masks it behind
   the server. Also we can more easily implement a timeout etc.