A reg key question.
Is the detection built into the patch executable (KBxxxx.exe) so does it fail to run, or is it just WIndows Update that detects it?
So if you approved the patch in WSUS or roll it out via SCCM do the clients install it anyway even if the reg flag isn't set?