That’s a good point. LDAP/AD-backed SSH key management is a solid approach, especially in environments that already have directory infrastructure in place.
Centralizing authorized keys and avoiding local authorized_keys sprawl definitely improves auditability.
The scenarios I was thinking about in the post were more around smaller cloud-native teams that don’t run LDAP/AD at all, or where servers are fairly ephemeral and identity is managed elsewhere.
In those setups, distributing and rotating SSH keys — even via automation — can still become operationally noisy.
I agree that directory-backed key management is a strong pattern when that infrastructure already exists.
Centralizing authorized keys and avoiding local authorized_keys sprawl definitely improves auditability.
The scenarios I was thinking about in the post were more around smaller cloud-native teams that don’t run LDAP/AD at all, or where servers are fairly ephemeral and identity is managed elsewhere.
In those setups, distributing and rotating SSH keys — even via automation — can still become operationally noisy.
I agree that directory-backed key management is a strong pattern when that infrastructure already exists.