That's not really how it works but deriving is not publishing copyrighted content.They know how their software works and the atmosphere source code tells them exactly where the bug is, there is no reverse engineering required.
They just need to think of an extra layer they can add to prevent it, each time we go through this the greater the chance they come up with a really good way of hiding the key.
What law do you think allows the CFW to derive it but makes it illegal to post it?
The key is not copyrightable, but the DMCA probably makes posting the key or software to derive it illegal.
Yes, numbers can be illegal and copyrighted, so sharing them can be illegal. Hence why BYOK now, and derived later.