They want the key, verifiably off the box, in clear text. Any usb stick. any sd card. Not great, but not any barrier that's worse than needing to setup a microsoft account.