IIRC, the traditional way around such legal ambiguity is for the project to offer a configuration variable akin to "input your favorite private key here." If the user is in a country which permits use of the AirPlay key, great, if not then the project can continue to operate as before. Either way, the project is indemnified because /they/ didn't provide the key.
In fact, I don't see how this private key getting "outed" is going to hurt Apple at all in any countries where things like DMCA exist.