The git ssh keys need to be deployed to Google KMS for the deployment of the website - see cr_buildstep_git - this only needs to be done once per Git account. You then need to commit the encrypted ssh key (by default called id_rsa.enc)
See Also
Create your own custom deployment using cr_buildstep_pkgdown which this function uses with some defaults.