Excerpts from Nick Coghlan's message of 2014-11-19 10:48 +10:00:

Is there a way to get a whole group's SSH keys onto a system without going through the scheduler?

No, short of adding an explicit ks_appends which writes to /root/.ssh/authorized_keys the same way the Beaker ssh_keys snippet does.

Or is manual provisioning currently restricted to only added the SSH key of the user provisioning the system?

Yes it is.