In the ideal world, there is no decryption key. They should use a one-way hash of the encoded fingerprint.

They might want to do approximate matching, though. That could make it hard or impossible to do without the decryption key.