For bulk orders, you might want to look into light sensors or other devices that could tip you off if the package is opened. Then get a PO box in a fake name and if you believe the package is compromised and a CD is coming, throw away the key and never visit that post office again. There might be something better than light sensors though. Quite often the packages are x-rayed first, so they could determine a device like that is inside and simply open it in a darkroom.