I think the point of API keys is so that if you were to build and publish an abusive client (think badly written iOS app), it's easier to stop the DDoS, rather than having to ban thousands of end-user IPs.
This helps stop developers from putting lazy API calls on the client side instead of caching, for example.
For instance if my website includes a feed of my latest posts to a third party service I should be caching them myself and serving direct to visitors, rather than using a client side request coming from every visitor's browser.
Obviously this sounds like common sense but you might be surprised :)