Comment by prussian

Host certificates are fine, but user certs are pointless landmines when features like AuthorizedKeysCommand exist. why worry about revocations, expiries and all that noise when you can simply have some script just pull the allowed keys? sure maybe login is a bit slower, but does that matter much?