The GPLv3 does not require you to provide a key. It only requires you to provide a way to bypass the need for a key. Allowing a user to add their own keys or even the option to disable the need for a key is fully within the bounds of the GPLv3.
There's also the outstanding issue that if you only supply software, then you might not even need to do anything to comply with the TiVo-ization clauses of GPLv3.
Interesting, but I think this needs further analysis. That bypass mechanism must also comply with the “no additional restricions” aspect of the licence.
There's also the outstanding issue that if you only supply software, then you might not even need to do anything to comply with the TiVo-ization clauses of GPLv3.