If any app that has an embedded webview allows to bypass parental control, then this is an even bigger bug in Android…

(without even talking about this key management stuff, because at this point it's merely speculation as the author didn't test what they actually do: “you have two methods which I don’t know what they do, but they sound scary”)