My huge takeaway is that you can specify the shell for each key you allow to connect. I have been tweaking /etc/shells like a dope for the past 15 years. So what this means is that, when you add a key to your authorized_keys file, you can also set an optional parameter that forces the command they are going to run (overriding any command they thought they would run instead).
Yup. Gitolite uses this method for authentication. The admin configures the public keys to be forced into the gitolite command, and then gitolite can handle access control: http://gitolite.com/gitolite/how.html#(11)
Sorry for linking into a slideshow it's just the first link I found. Arrow keys left/right navigate.
