GitLab masked variables reject values with whitespace (like SSH keys), so store the key as base64 and decode it in the pipeline.