I have read some speculations how the system works, so I'll throw a quick explanation how the EWS works. Starting EWS3 and all the way to 2008 models, there are 2 forms of identification between EWS(CAS) and DME/DDE- ISN number which is permanent and doesnt change and is OTP(one time programmable) and a rolling code which changes everytime the engine is started. Up to 2008 the ISN is 2 byte code. Blank (brand new) modules can be purchased from BMW and programmed with the respective ISN after the module is installed on the car. Starting 2008 ISN changes to 16 byte (128 bit encryption, same as one visits a bank site, etc) and is specific to each car and known only to BMW. This means that blank modules cannot be purchased anymore. they are ordered by VIN and come pre-prgrammed with the specific data. Rolling code still exists. In certain conditions the EWS and DME/DME can loose sync on the rolling code and can be re-synced with the function EWS/CAS-DME/DDE adjustment -->reset start value.
In any case, if there is a problem there the DME/DDE will throw a code "EWS interface manipulation".
The keys were stored in the CAS only until some time in 2011. After that new CAS firmware(s) were released and the key has to be registered in the DME/DDE also. I am not exactly sure, but if the key is not recognized by the DME/DDE the car may not start without throwing a code for manipulation.