Current Developer Keys allow for all HTTP verbs to be called including DELETE, PUT, UPDATE, POST whilst all analytics applications would only have read only access via GET method. Having the update or delete APIs exposed increases the chance of unintended or hostile removing the data or changing the environment unintentionally.
An analytics developer key that only provides access to the Canvas GET APIs would solve this problem.