Of course they do have access to these keys.
Their own code runs on the device. They could very well have the OS communicate the keys back to RIM's servers.
They could of course have some code on the device which reports this back, or failing that something which lets them force an update to the OS to add this functionality.
But if they haven't put either of those in place already then it's too late. They'd be relying on customers updating the software themselves, which is unlikely - especially for many security conscious companies.