Hi Joseph, welcome to CodeRanch!
This is not going to work because classes can access protected members of classes in the same package regardless of whether they inherit from them or not.
The layer of indirection you add using Supplier is not going to actually do anything, you might as well just use an array reference directly.
You should also avoid global state: don't use static variables.
The solution is actually quite simple: classes that require the key should request them using constructor/method parameters, and classes that have a key should only pass them to classes they trust.
By the way, limiting the visibility of the key is not going to do anything security-wise. When any object in your application has the key, anybody with access to your system can just dump the memory and read it.