IIRC, the traditional way around such legal ambiguity is for the project to offer a configuration variable akin to "input your favorite private key here." If the user is in a country which permits use of the AirPlay key, great, if not then the project can continue to operate as before. Either way, the project is indemnified because /they/ didn't provide the key.
