I managed to do it with a hack. I documented it in this note, but short version is: 1) pass each module’s deploy key to the build via environment variables, 2) run build with a custom script that clones each module via git-ssh, and 3) point hugo to the locally cloned modules using the replacements mechanism.