The GCE variant is also mostly more of a safety benefit than a security benefit, but it does have one security benefit: if a user is subsequently removed from the metadata server, or if the key is set to expire (experimentally supported by our agent and used by this nifty feature: https://developers.google.com/compute/docs/ssh-in-browser) and they're removed from the GCE project, it's easier to clean up after people who used to have access but shouldn't any more.

- Jimmy