OIDC authentication to Google Pub/Sub Lite

[ysk24ok]

I'd like to use Google Pub/Sub Lite as a Kafka broker.
This doc says a service account key JSON file must be generated for a Kafka producer or a consumer to authenticate to Pub/Sub Lite, but our organization doesn't allow the key JSON file creation for security reasons.

This section and this section say that Java-based Kafka clients can access Pub/Sub Lite without generating the key JSON file. But since the framework we're using uses confluent-kafka-go which is based on librdkafka, we can't use the method as librdkafka doesn't support sasl.jaas.config and sasl.login.callback.handler.class.

Is there a way for librdkafka to access Pub/Sub Lite without generating the key JSON file?