Ideally I'm viewing this as a fairly simple feature to add. Also I'm hoping this will help Mr solidify best practice for how to do things.
Where I'm getting confused is what should be creating the user/key entries. I could make this part of the options for creating a key( aka passing in a user-id) and failing if it doesn't exist etc. Then creating the mapping on after-save for the key. Or I could implement this as its own controller, and put some of the logic in there.