A method that has stood the test of time here is to have the key on a long, strong piece of string anchored to the top hinge inside the boot door. Long enough to reach the filler cap and no further, the door must be open for the key to be accessed and when the filler cap is removed the key remains in the cap. Put it on the boot floor, step recess, wherever, and when filling is complete the cap has to be replaced and the key then removed and put back into the boot and the door then closed.
I've not know that solution to fail.
Re the hot refueling photo of the Wildcat refueling in Canberra, ACT, while on bushfire ops. That is a refueller from the service provider, fully approved by RFS for hot refuelling, and the later image shows an ACT firefighter in attendance. CASA regs allow the pilot to leave the controls under certain constraints all of which are met by a Bell 212. This has been discussed many, many times in Rotorheads and still has the same aghast responses from other operating areas. We do it and it works.