I wrote a tool that lets me use keys in my ssh-agent for google cloud. This way, a vm can run with minimal privileges but when I ssh in I get gcloud cmdline with full control.

It is very easy to connect to the agent and ask it to sign something.