Add repo keys on new instances, not pre-baking