Can't you set up keys that are only allowed to do GET/PUT?

I know that tarsnap [1] can work with `list`, `write` and `delete` keys.

[1]: http://www.tarsnap.com/man-tarsnap-keymgmt.1.html