I think your only choice for doing this securely is to hide the keys behind your own server.