Obviously a read-only deployment key is all about creating code on a build server. One challenge for us that makes deployment keys unusable is that our build server pushes tags when a build has completed successfully.

It would be nice to allow deployment keys to push tags to a repository.