Permanent non-interactive login

I need to login from the CLI non-interactively.
Oneshot mode is useful, however it does not satisfy my use case.

I use Ansible to provision a suite of virtual machines on my desktop and on a couple of servers. I use keybase repos extensively. Even when the ansible playbook isn't running, I would like to remain logged into a read-only account to facilitate automated synchronization.

Right now, I have to ssh into a new machine to login interactively, as expect is not acceptable in a production environment as each new machine modifies the numerical IDs.

This is exacerbated by the fact that it is a readonly account. This means that I must also ssh into a machine which is always logged into the readonly account and only exists for that single purpose, just to provision a device.

In practice, this means logging out of my non-readonly account on one machine, logging back in as readonly, provisioning the new machine, logging out, and logging back in as the non-readonly account. This is a major headache.

A simple --paperkey option for keybase login should suffice.

Start at the keybase login CLI entry point and compare its existing oneshot mode with the requested permanent non-interactive flow. Define how a --paperkey login should support automated read-only synchronization, then verify the behavior with the login-related tests or CLI checks.