I looked at it a while ago using OpenSSH's AuthorizedKeysCommand feature and found Phabricator's implementation for vcs over SSH to be the most understandable thing I could find.

https://github.com/phacility/phabricator/blob/master/resourc...

https://github.com/phacility/phabricator/blob/master/resourc...

https://github.com/phacility/phabricator/blob/master/scripts...