[targonca]

    keys = (f"command=\"buildsrht-shell '{b64key}'\",restrict,pty " +
            f"{key_type} {b64key} somebody\n")

Now it depends on how b64key is sanitized.