Basically the admin group can read the gengo key. When adding website_gengo that adds the website groups, the groups allowed to access the key are updated. This is done because in base_gengo the website groups are not necesssarily defined. Website is not a dependency of base_gengo.