But if they re-ask the key, don't you commit a second count of offense by refusing again? If so, can't they trap you in a loop of two years sentences until you give up the key?

No, it's not 62M / 150K per day. First, there's up to one connection per family, not one per individual. More importantly, some addresses will appear multiple times, some others will never appear. Finally, the 150K figure can't stay that high: after a while, either all the pirates will be disconnected, or they will have moved to safer pirating technologies, or the law will have been repelled as a resounding failure (the two last hypotheses aren't mutually incompatible).