For those interested in this approach, but who would prefer fewer moving parts on the actual machines, I have had great experiences with Vault's signed SSH CA support, which includes the ability to get very short leases assigned to specific user accounts: <a href="https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-certificates.html#signing-key-amp-role-configuration" rel="nofollow">https://www.vaultproject.io/docs/secrets/ssh/signed-ssh-cert...</a><p>It's possible the Keybase CA bot solves other problems, but as far as "quick to get started," one cannot beat `curl -sSfo /etc/ssh/trusted-user-ca-keys.pem <a href="https://my-vault:8200/v1/ssh-client-signer/public_key" rel="nofollow">https://my-vault:8200/v1/ssh-client-signer/public_key</a> && echo 'TrustedUserCAKeys /etc/ssh/trusted-user-ca-keys.pem' >> /etc/ssh/sshd_config && systemctl restart ssh-server`