It's not that bad, it's part of the user data and should be provisioned the same way. OpenSSH can also be used in a PKI fashion, where you use certificates ins

It's not that bad, it's part of the user data and should be provisioned the same way. OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.