SSH the Grown-Up Way: Certificate Auth, No Passwords, Revocable Access
Your servers trust one CA public key instead of a pile of authorized_keys files — and every credential expires on its own. OpenSSH has had this since 5.4; here's how to actually turn it on.