I'm working on a project where we use git-secret for hiding information. This is backed by gpg, and adding people to git-secret (http://git-secret.io/) is done by adding a public key to a pubring.gpg. After starting with a clean computer, I had to generate a new key and add it to git secret. Usually someone else does the adding, but I decided to try myself, and to my surprise I was able to both add and remove users to this pubring, without my key being part of it.
Is there a way to limit the access to modifying a pubring, so that only users with their public key inside of it can add or remove keys from the pubring?