Maybe somehow put the key in the url (via pushState) and then hotlink an offsite <img> logo, grabbing the key via the referer header at the offsite httpd?

Or somehow trigger a DNS lookup with the key as part of the domain, and grab it at the offsite DNS server?

Or maybe something with RTCPeerConnection, wasn't there some drama about how that's leaking IP adresses without showing up in the devtools?