There are pros and cons for both options:
A single master key for your Ansible account would reduce complexity but you would need to ensure the private key is very secure, even if the key were password protected you would want to ensure the key is encrypted at rest with a tool like BlackBox and backed up somewhere.
System unique SSH keys would help with ...
Q: "Does the hosts: all pattern only match hosts specified in inventory, or does it also match add_host hosts?"
A: Simple test shows hosts: all includes also added hosts by add_host. In the same playbook, of course. The dynamic groups live inside a playbook only.
Given the inventory
shell> cat hosts
- name: Only 2 ...
There are a couple of things here:
The indent of "with_items" on the debug module is wrong, it should the same level as the "debug" word.
More importantly, in this case the "with_items" variable on the debug is wrong. When you added "register" to the cli_command module, you actually said "collect the output from ...
This sounds like you are applying Ansible playbooks locally on peoples workstations.
The best way to protect this would be applying the playbooks using a remote system, like AWX or a CI system such as GitHub Actions or TeamCity. The CI system would have the ability to decrypt the vault and run the playbooks.
Mostly the CI system can expose the vault password ...
If I understand the question correctly, the problem isn't really related to ansible at all. What you need is a package repository on the local network that can cache or mirror public packages.
There are a number of deb specific options like rsyncmirror or apt-mirror. There are also generic options that hold many different types of binaries and package feeds, ...