What they've done so far is open up part of their API to the public, while keeping more of it for themselves. I expect it's only a matter of time before they start opening up the rest to paying customers, who will get their own secret key, linked to a site's domain, which can be retrieved through the HTTP Referer header.

The signature would act much like an API key does today, except that by combining a secret with a product of the chart's arguments, the signature will vary for each individual chart, and Google can trust that the person who generated it is a genuine customer, and that it hasn't been modified along the way. It would no longer be possible to simply copy an API key and fake an IP and Referrer value, it would still require something extra, which only Google and its customer would know.