If you want the key, there's a different, older method, which involves sniffing current with EMI probe. This doesn't require access to JTAG pins. Once you have the key, you can build and sell any number of fake devices which will work with manufacturer's bitstreams, so they will be indistinguishable from the originals.