Keys only do signing, that doesn't mean much if it signs anything without a policy engine or if the invoices being served (a node is inherently a server even if its used like a client) are issued by someone else

That kind of dodge is even more red-flaggy

I assume the fee is collected with wrapping, so its entirely trustodial in that your service is who gets paid first and opaquely