Thanks, sorry for the confusion. So what they needed but did not have is an authorization (not authentication) callout after the daemon has verified the remote user's identity (vs. the built in 'callout' of looking at a user's authorized_keys file).

Hmm, I think this part is still about authentication as sshd cannot authenticate the user without the keys. According to the article, GitHub does the authorization in their Gerve script.

This is all sort of pedantic but the way I read the situation is that the only authentication is proving that the entity on the other end possesses the private key associated with a certain public key. The authorization part is two fold: is key X authorized to access account Y. And then it's passed on to Gerve for more specific authorization checks. Having implemented such things, I am probably thinking more about the internal situation, sorry..