SSH certificates expire on their own, which is the point

Managing authorized_keys across thirty servers means a configuration run to add a colleague and another to remove one, and the removal is the one that gets forgotten.

# sign a user's key, with an expiry and a principal
ssh-keygen -s ca_key -I 'turker@example' -n deploy -V +8h user_key.pub

# on every server, once, and never again
# /etc/ssh/sshd_config
#   TrustedUserCAKeys /etc/ssh/ca.pub

# revocation is: stop signing.

Access that ends by itself removes the class of incident where a departed contractor’s key is still on a server two years later. Servers need no per-user state at all, so adding a machine is one public key rather than a synchronisation job. The CA private key becomes the most valuable secret in the estate and needs to be treated accordingly — offline, or in hardware — which is the honest cost of the arrangement.