This just seems to be a case of Not Invented Here syndrome. Using gitolite or gitosis would have done the job faster, gives you the ability to have acl's set up per user and all of it uses simple configuration files.
Edit: Hah! That's basically what it is, just dressed up with a tiny script and the two-factor trick from last week. Never mind then. This is sane. Just maybe oversold.
Gitolite is a great project and it has many useful features such as branch-level access control. That might be what he meant by "overkill". He simply didn't need those features. I think there's much to be said for keeping things simple.