Anyway, here's a must: having a different key for uploading a model and doing inference with it. Or even, there should be a set of keys for each model, with each access logged separately.

Also, if someone uses my model, do I pay for it?