Comment by rollcat

The remote system must generate its own SSH private key; you could use that opportunity to deploy the authorized keys before sealing the system as read-only.