Deployment key for one branch only


I’d like CircleCI to do my deployments, but currently the deployment SSH key will be available to all builds, which is insecure. I’d like to set ‘master’ as a protected branch on GitHub, then CircleCI to add an SSH key to the local environment only if the build is in the ‘master’ branch.