we may want `write:public_key` eventually? Won't we need that for repo cloning?