An automation engineer is building a CI/CD pipeline that must pull containers from the organization's NGC Private Registry to a production Kubernetes cluster. The engineer wants authentication that does not break if any individual user leaves the organization. Which NGC key type is most appropriate?