Unfortunately there are no instructions about how to implement what they say in that last sentence (restricting the domains for browser keys). I've been hunting around the menus and haven't been able to figure out how to do it.
The closest I've gotten is: In https://console.cloud.google.com I clicked on the hambuger and selected "API Manager," then clicked on "Credentials," clicked on the tab labeled "Domain verification." I have no idea if that's the right place to go to, but it's the only place that I found that mentions domains. While on that tab, I clicked "Add domain" and added a domain. But that didn't restrict the keys to that domain. I tested the Browser key on a different domain, and the key worked on that other domain.
Can anyone provide step-by-step instructions for how to make the Browser key only usable from one domain?