Security of key distribution from causality constraints