Service ignores API key settings, passes hash, etc. to my function

I'm trying to build a service that talks JSON to a program. I've built a simple module, and I can run basic queries. The problem is that my API key settings are ignored. I can change the nonce parameter without changing the hash, and the request still succeeds. I can also run queries an hour after they've been created, with the old timestamp (or with a randomly modified timestamp). Same thing with the domain, it makes no difference.

What's more, I get the hash, nonce, domain, and timestamp passed into my function when I have API keys activated. I don't get what I'm supposed to do with this information there, do I need to check these things manually?

I'm using the JSON server and Services, nothing else. I would appreciate it if somebody could help me with this. Also, a working example using API key authentication would be appreciated. All the examples I've seen turn off the keys in the first step, or use user login instead of API keys.