Even though the web site never sees the cardholder data or sensitive authentication data in the clear, and never has access to the encryption keys, I would think the web site is in-scope because it could affect the security of the data. If the web site is hacked and changes the redirect to go to a hacker site, data can then be stolen.
In the case I am working now, the web site is owned by a service provider that a merchant is working with. The service provider is not the 3rd party that deals with the card data. If I am correct it leads to a slightly weird situation where there is no CDE (cardholder data environment) at the service provider and they only have this one web server that is in-scope. Although there is a question of whether other servers on the same network "segment" as the web server should get pulled in-scope too, but that is a different issue.