@civodul @khinsen @akkartik @glyph It doesn't forces out-of-band or in-band.

In fact here I made it in-band: https://hacktivis.me/git/utils-std/file/authorized_keys.git.html

Sure it doesn't have the signature-tree of Guix authorization file but I would say you don't need such a format if you check for signatures before applying a commit (could be done via git-hooks), which also means access can be trivially revoked or limited (valid-after/valid-before).