Got it!
After reading the code of TYPO3\Surf\Task\Git\AbstractCheckoutTask again I found out that it may be useful to add an
$application->setOption('sha1', 'xxxxxxxxxx');
to my definition and now it works.
@Carsten,
at the moment I am not able to use a deployment key for this :-( but later on I will do this.