Just to clear things up, I was only talking about encrypting local datasets and not buddy backup. 🙂
No, you only need to have the keys once, when mounting the dataset to a new server or fresh install, afterwards you can save them in the OS and don't need them anymore. This will not be a problem with local UI dashboard. It might be that it's just stored in a Vault on the Hexos Server and you can retrieve them from there, or that during the setup, which requires an Internet connection anyway, they are automagically fetched from there or sth similar. Or the Eshtek team is not going to store the keys at all for us, I mean we are only talking possibilities and dreams at the moment 🙂 But, as @TheGlitch already mentioned, if you have them in a vault and that vault is an app in Hexos as part of the encrypted dataset, you are out of luck.
Also, in case where the Hexos Server gets compromised, and the keys leaked, for local datasets this should be less of a concern, because typically, they shouldn't even be accessible from the outside in the first place and 2nd you can easily change them.
And you can even make the storage of the keys optional.