This sounds like basically what I use READMEs or supplementary Markdown documentation files for, just in a bash code block in a Markdown file rather than in a bash file.
The difference is that every time you do the process, you can consider writing a couple of tests and automating the step.
That's true. I guess I tend to just use those as examples/documentation at the start, and then when I want to automate the process, I do it more in an all-at-once way (with a Python project or something) rather than incremental additions to a bash script. Do-nothing scripting does definitely sound like a technique I should try out. I'm not a huge fan of bash for stuff beyond a list of short commands/steps, though.
Yeah, at our company things are done in the reverse of that script: the user generates their SSH keys, and there's a process they use to register the public key with the rest of the system.
I sometimes use GitHub for this. A developer's most up to date keychain is probably their GitHub account, so granting them access is as simple as curl -Ls github.com/turbo.keys >> ~/.ssh/authorized_keys Simplified of course. A script is usually used to revoke that access shortly after. Plus 2FA SSH.
I had no idea about github.com/$USER.keys. That's handy as hell.
Implementation question: Whats a good way to generalize such a python script so that windows and nix users can run it?
The best way is probably a bootstrap script ie. ps1 or sh which supplies the platform-specific parameters, and can pip install any script dependencies. So, 3-file solution.
Additonally, this can be generalised to a CI platform as python can subprocess-run anything there's not a native lib for.
Lastly, you could do autodoc via the script for a complete solution.