My questions refer detecting fake User-Agent, in sense of spoofing user OS, web-browser and other info sent in headers from users browsing resources on my server. 

Is there a way to detect if user is using some tools to fake his fingerprint, e.g. by setting a fake User-Agent? Is it possible to detect if a user changes it's headers by browser developer tools or some other more sophisticated anonymization software?

Public Keys are designed for sharing, read access to and or publishing a public key is fine
Private Keys are secret, they should only be accessible to the owner of said private key.
To drive this point home, think back to every HTTPS website you have ever visited.  In each case, as part of HTTPS the site gives you their public key.  So not only is it safe to publish it, it is intended to be this way.  For example, if you click on the green lock icon on your address bar, you can find the public key for this website (if you are viewing it on HTTPS)
*.stackexchange.com

Modulus (2048 bits):

BD 15 6A 1B 0A 03 69 CC 00 99 A0 4E 9E 31 99 34
3F 32 B8 6B 7C 62 0A 4D DC 45 41 72 8A 3E 92 DA
B3 64 45 B2 31 59 DE 71 60 D3 E3 26 91 DE 55 0D
3C F1 8C E2 C3 4C 01 F1 39 B4 A1 45 D5 9A 77 05
FC 2D 92 C6 B9 CE 10 4D DB 6F 7B 72 44 C0 18 38
4E B3 5E 3B 59 74 5C 52 E1 E7 3F E9 1C B8 23 F5
94 99 BE E7 BC 19 AA DE C0 6A C4 5E 4C 83 2D 5E
3B 1F 7F 97 56 42 28 C9 9E E4 D7 E8 45 E2 E1 D5
D5 E3 FD 73 01 D5 59 49 7C 97 82 F4 F3 AC 09 5B
4D 88 A1 F0 A3 7F 9A D6 2E E1 32 78 5C 0E F8 7D
74 E5 1C E8 C5 62 5A 78 AF 3C C4 51 75 FA F8 41
C4 5F 60 47 CE 81 80 83 57 6A 6C 31 29 EA C8 8A
CB C8 8C 3F 50 51 F0 06 F2 D2 24 18 60 87 7D AB
B0 6F 81 F6 3E B7 F1 F3 6F ED 67 73 41 EA FF 83
61 CA C3 2C A6 44 F2 58 21 6C C9 DD EC 95 85 7C
B2 AD E4 35 E2 9B 9F 82 0C 7A AB 58 18 0E 54 97

Public Exponent (24 bits):
01 00 01

Further examples of this can be found on github.com where they request that you attach a public key to your account for use with git clone git@github.com:<user>/<repo>
You can actually check the public keys of any user on github with the following URL
https://api.github.com/users/<user>/keys
mine is listed as:
[
  {
    "id": 18667533,
    "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDraswAp7EbMwyYTzOwnSrsmr3nNMDaDf4e2YVaehLc9w6KN2ommomXZO8/V9N3yINNveGqrcVc9m2NTm04iILJUKd9o25ns8QIG6XSCt9SVx/Xw1J/SXfIWUKuEe0SgmIwVwkk8jetfG/Z7giSiU3dxxC4V9lHQCFgKOKBWGpNbINmqtmBWncX3HJKeXrpSddoePbZZ84IEFr4CWUlqoXyphpxqzpfA9sRpVTtyBPcUSj68j4+gKgEQN65G6LXys3q8BiwWxucci6s34vp4L8jKn7uYh26vLuT1oIbODJphCmpvMH+ABPkNQcFBk4rRLpCEAsoAhmvTk/NjnfZM+nd"
  },
  {
    "id": 21175800,
    "key": "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC5tPV481acCZ5wm2E15gXkVRaKCE3lic/O8licyzW+eDE9rPpG4rHRRH9K2ENmstUh5nLEenb0nNhEGnsf3pIJRZ07JXwv16+lsJBSS8+YiWeMBlwo+JNaxwSyUlYUgl1ruogr0nR0KBqsYSWXuG0s2jm2IOV+0B/0fzDR/tiLFLj50+iJ9qCDSk/8fAsXz2xG39KcUcxmCbDXb/qSdESWaZc+pafNRiCcVNfMkKeDViWlzI4VkiTcfVCraHUuYx4jgOBB526dRWSDG9bLchwlJiopgT+k4X/TNe2l01DPwYetwLvY6V8rcPrjjJL8ifRTMSof1zRIoBgJZhRzWc1D"
  }
]


The exact opposite is true of Private Keys which should be secured at all times and never given to a third party or exchanged via email without encrypting them.
If someone has accessed your private key, they have the ability to access any device or encrypted file that was protected with your public key.  It also means that they can sign things on your behalf. It is VERY bad if someone has gained access to your private key.
In many cases SSH Clients will not function if it is detected that the permissions of the Private key file are such that users other than you have read access.
