Hey Joe, just to pile on...
If you had have supported API key scoping then I'd have a ton of businesses/startups running on you. As it stands currently it's difficult for me to recommend you to orgs that are scaling up. Compliance in particular was the biggest issue. For one-man shops it's a no-brainer.
In your defense, Cloudflare has historically also sucked in this area.
Anyways, I'm looking forward to this feature!