What about supporting github read/write deploy keys? Those can be generated with permissions for a single repo, no?