That's a good point, it's unlikely there's more than one gemserver. Still, it feels a little weird to use key/value metadata instead of a "first-class option" to implement a relatively important form of security for private gems, but maybe that's just needless formalism. If you're sure this should be implemented with metadata, just let me know.