Comment by OrvalWintermute

I've always thought of SSH host certificates as somewhat of an abomination and maybe I am in the minority because the better solution was always about making SSH speak x509 properly

https://roumenpetrov.info/secsh/index.html

Roumen has been regularly updating this for a pretty long time now.