sounds like you auditors and IT directors are idiots. However, I would follow this to the letter and when a system goes down or a back up fails you need to tell him/her that you are working to his constraints and that this can only be fixed as quick as you can get a new key. The only people that should be band from making changed to production are developers.

Regards,

Terry