There's one thing you can do without editing system configuration files to get most of what you want. You'd just use
~user/.ssh/authorized_keys and all the rest like normal and make those immutable.
You can set the
~user/.ssh directory immutable, which prevents moving it or deleting it, which is important if you don't want them to create a new
.ssh with their own contents. It also prevents adding, moving, or deleting files within it.
You can set various files (like
~user/.ssh/id_rsa.pub) immutable, which prevents moving them or deleting them. It also prevents editing them.
Note that immutable directories and files are protected in this way even against their owners. They're even protected in this way against the
root user until
root removes the immutability.
Make sure to set the permissions for the directories and files properly for privacy before setting them immutable, since immutability blocks even that.
You set something immutable like this:
sudo chattr +i [directory path|file path]
A particularly convenient command protects
.ssh and all files within it (recursively if you have subdirectories) in one go:
sudo chattr -R +i ~user/.ssh
To turn off immutability to change something (make sure to turn it back on when you're done):
sudo chattr -i [directory path|file path]
Note that a quick way to be able to edit whatever you want is:
sudo chattr -R -i ~user/.ssh