You aren’t “sending” the key anywhere, you are downloading the report and decrypting it locally.
https://support.apple.com/guide/security/locating-missing-de...