Sure, I can do this with /usr/local/sbin/adduser.local, but it would
be nice to move this upstream: an option --ssh-id=/path/to/file
which sets --disabled-password and install the given file as
~newuser/.ssh/authorized_keys.