I don't know if this is any help to you but at the school where I'm the Moodle Admin I've got every course self-enrolling for students, it's frankly easier that way a lot less hassle. The teachers only use enrolment keys where they require the course to separate into groups.
What I've done where a particular member of staff needs to be put in is to manually enrol them as a teacher rather than letting them self-enrol. As long as they've got a Moodle account you can find them in the users list. Of course this doesn't prevent them going into other courses and self-enrolling but the self-enrol is defaulted to 'student' so they can't change anything on a course they enrol onto.
The staff members, thus manually enrolled, are then pre-enrolled on the course and don't require keys when they try to access the course.
Plus I think you've misunderstood enrolment keys in part as the application of enrollment keys to a course, retroactively, will not suddenly require your 1400 students to require the key. They would only need the key if they unenrol and try to re-enrol on the course, they are enrolled already.
If it's any help I describe the enrolment keys to teachers as putting a 'bouncer at the door of their course', "if your name's not down you're not comin' in, unless you've got the password?" give the bouncer the password (enrolment key) and you're into the course, you'd only need the password again if you leave the course (unenrol) and try to return (re-enrol). If the teachers then use groups with separate group keys, you are giving the bouncer a clipboard with all the passwords and he then directs the student to the correct part of the course (group) by their password.
If you do find a role based solution please let me know as I would be interested in implementing it.