ssh catch 22

[Ed]

Hi all,
I'm stuck with a little dilemma and I thought someone could give me a little 
advice.

Is there a way to use rsync with an ssh certificate?

what I have:
----------------
First of all I am forced to use the root account with ssh which I know is a 
big no, no, but sometimes it can't be helped.

Second, I need to use a certificate without a password as root which is even 
worst than point one so I thought I'd secure as much as I could and did the 
following.

what I did:
--------------
a) in the sshd_config of the destination PC I set "AllowUsers" to 
root at sourcehost
b) in the certificate, I specified the command that could be run... the likes 
of: "command="rsync -av ./source root at desthost:/destination" ssh-rsa"

my problem:
-----------------
Now if the command was "ls" the source would only be able to return the result 
of an "ls" on the destination PC.  

The problem I am facing is that my rsync command found in the certificate 
won't execute an rsync from source to destination but rather, like the "ls" 
example, it will run the command from the destination PC and thus try an 
rsync from destination to source.

Was that clear?  Can you advise on a way to automate an rsync via ssh?

Many thanks
 -Ed