I think I found an acceptable solution. The webView ANE that I use allows me to talk with Javascript. So I download the Google API key from my database, pass it to the maps HTML file through Javascript, and everything works great. This way, my API key is never in any files on my users device. If somehow somebody ever actually got my API key, I could roll it over to a new one, but my apps would not break.
-- Sent from: http://apache-flex-users.2333346.n4.nabble.com/