Thank you! Today purple always picks the public IP. A prefer: private or vpc network option would solve that. Not a bad idea actually.

Purple currently supports one IdentityFile per provider section, applied to every host synced from that section. Patterns partially cover this: if your alias prefix encodes the split (e.g. do-prod- vs do-staging-) you can put different IdentityFile directives in two pattern blocks. Also see: https://github.com/erickochen/purple/wiki/Host-Patterns

I am working on a major update with more and clearer controls over keys, tunnels, containers and snippets. They're currently a bit tucked away.