My understanding is that the key swapping is done injecting the real credential based on the host/path. I think this breaks if I have two different keys for the same host/path that I want to use. You might be able to maintain a mapping between fake keys and real keys and support multiple keys per host/path.

I have not looked closely at the code so I may be mistaken on how it works, please close if so.