There's also a command argument that can be provided in the authorized keys setup, which can force connections with a particular key to hit an entry-point application.