TA_CheckAndSavePKey() never contacts any server. That's reflected in the fact that it never return TA_E_INET (see TurboActivate.h for all possible error codes).
The verification of the product key is done completely client-side (this is to not waste our server's time on the first easy filter -- i.e. customer mistyping and misunderstanding)
>> "I wonder how well LimeLM handles malicious ISPs inserting crap (ads, cookies) into HTTP requests."
Very well. We've been dealing with this garbage for over a decade (every possible insane configuration you can imagine). If something tries to MITM data to/from TA or TF they will get a TA_E_INET.
But TA_CheckAndSavePKey() never talks to a server. This is a customer problem. They're typing something wrong, copying and pasting something wrong, or have modified your installation.