Managing authorized_keys across thirty servers means a configuration management run to add a colleague and another to remove one, and the removal is the one that gets forgotten.
# sign a user's key, with an expiry
ssh-keygen -s ca_key -I 'turker@example' -n deploy -V +8h user_key.pub
# on every server, once
# /etc/ssh/sshd_config
TrustedUserCAKeys /etc/ssh/ca.pub
# revocation is now: stop signing. the certificate expires on its own.The expiry is the whole point — access that ends by itself removes the class of incident where a departed contractor’s key is still on a server two years later. Servers need no per-user state at all, which makes adding a machine a matter of one public key. The CA private key becomes the most valuable secret in the estate and needs to be treated accordingly, which is the honest cost of the arrangement.