Appearance
Styling, export and integration
Domain locking
A key names where it is good
A key sold for a site lists that site's hosts, and holds only on a page served from one of them. The plot reads the page's own location.hostname when the key is activated and checks it against the list. The demonstration above prints both, and what the plot made of them.
A host is written exactly, as lab.example.org, or as a wildcard, *.example.org. A wildcard covers the bare name and everything under it to any depth: example.org, app.example.org and eu.app.example.org. A customer buys a domain and gets the domain, and does not find out in production which subdomain was left off.
A key for software that runs on other people's machines cannot list them, and says so: its status reports hosts as "any" where a key for a site reports "listed".
A developer's own machine is never locked out
A key also works on your developers' own machines, so the key bought for production needs no change during development.
On the wrong host
The status is wrongHost, it carries the host that was checked, and the plot draws with the mark on. It does not stop.
A key is signed: changing any part of it makes it invalid.