give refreshauth.py a hook and call that in hgadmin hgrc
# WARNING: when these hooks run they will entirely destroy and rewrite# ~/.ssh/authorized_keys[hooks]changegroup.aaaab_update = hg update -C default > /dev/nullchangegroup.aaaac_purge = hg purge --all > /dev/nullchangegroup.refreshauth = python:mercurialserver.refreshauth.hook