Domain of :key

Currently we have:

    rdfs:domain foaf:Agent;

This seems slightly restrictive.  Many things can have a key, e.g. a
certificate, an account, an app etc.  Agent perhaps does not cover every
conceivable use case?

Is the parent of Agent an owl : Thing?