So my .gitignore had the /vendor in it, therefore when I ran composer update, there were no dependencies so it installed them again, which required the new key for spark and reinstalled the dependencies. Composer update will not reinstall your dependencies in your composer.lock file unless the vendor file and/or the dependency aren't there, then it treats it as composer install and installs any missing dependencies..
I took out /vendor from my .gitignore and just cloned the repository to a forge server, updated my .env and it works great.
There are two opinions about the composer.lock and /vendor in .gitignore, some say keep, some not. In the end I decided that having the files would help me down the road to know what dependencies I had used, in the event that it had been a long time between versions and I had done many commits on the dev side.
I also like having the /vendor with the dependencies as who knows, a dependency may no longer be available and then I'd be sol.
e