Maybe note here that if the Git server supports it (e.g. Github) you can assign the key to be read-only so it can't make changes.