Exactly. They don't need to prove you weren't hacked two or three times: they just need to convince a judge that it's unlikely. And the next step, setting up a regular key-changing scheme, simply results in you have to provide new copies automatically every time the keys change.