An ssh certificate instead of an authorized_keys file

Adding a person meant editing a file on eleven hosts, and removing one meant remembering to.

# sign a user's key, with an expiry and a principal
ssh-keygen -s ca_key -I alice -n deploy -V +8h user_key.pub

# and on every host, once
# /etc/ssh/sshd_config
TrustedUserCAKeys /etc/ssh/ca.pub
AuthorizedPrincipalsFile /etc/ssh/principals/%u

The eight-hour validity is what makes revocation mostly unnecessary — a departed colleague’s certificate expires the same day rather than needing eleven files edited. The certificate authority key becomes the thing that must be protected, which concentrates a risk that was previously spread thinly, and that is the trade: one secret to guard properly instead of eleven files to keep in step.