Yes, that seems to solve things, thank you!
It still acts a bit odd since it does (repeatedly) generate a keypair and send it over the line even if the repository URL does not adhere to the regex, but I guess entropy starvation is not a realistic attack anymore in 2022 and it’s an admin-only request, so there is no real security issue there.