To understand how the Google Compute Engine manages ssh keys, you need to understand how GCE manages metadata (since, as you wrote, they are in the metadata store).
And more specifically, the difference between project and instance metadata is crucial. To quote the documentation (see previous links):
, . , . , , Compute Engine .
, :
[...]
[...], [...], Compute Engine .
, :
, GCE / ssh ( , ~user/.ssh/authorized_keys - ~user) , ( ). , GCE ssh , .
, GCE , , , GCE: sshKeys.
, sshKeys, ssh GCE; .
: , ( ). , , , , , .
:
(, ubuntu) ( ubuntu: ~ubuntu), , ssh , ; authorized_keys GCE. , ssh.
: GCE, terraform Google