We do something similar, though we have a script that sets up the box. We use linode as well, so the script deploys a new box with a complex root password and

We do something similar, though we have a script that sets up the box. We use linode as well, so the script deploys a new box with a complex root password and my id_dsa.pub file. It also sets up /etc/skel and the profile files so that useradd uses them later. We don't use a single deploy user though, instead, each user with deploy perms is in the sudo group.