This will allow tenant admins to override the public key, but not the private key. We probably want this to be:

- publicKey: `{'tenantOverride': RESTRICTED, 'tenantView': true}`
- privateKey: `{'tenantOverride': RESTRICTED, 'tenantView': false}`