why not refine the multi-profile feature for keys?
for example, there are several profile (for example, 4 ) that not everyone needs access to, but only to the 1st and 3rd profile
when adding a key, you can make a multi-profile choice
, of course, it can be implemented through USERS, but then access is only possible via the WEB, and a direct ssh connection is not possible. (and it's a higher priority because the WEB is overly buggy)