There are two states that we're talking about.

* Ensure that the following key is present.

* Ensure that only the following keys are present.

You can accomplish the second one with the 'exclusive' flag.

http://docs.ansible.com/ansible/authorized_key_module.html

There's a third state as well: absent. Move keys from one file to another, and they go from allowed to denyed.

That said, I do like the "exclusive" tag too, I just tend to have a few one-off keys laying around as technical debt.

Not the OP, but say you were populating a directory of keys, you would simply remove it via file's state=absent and then repopulate.

You can have Ansible generate the authorized_keys file from a list of public key files, then when that list changes ansible will detect that the file has changed and will copy over the new file.

For a file, specify state=absent

http://docs.ansible.com/ansible/file_module.html

Yes, we run it once/only when things (people) change.