Manage them using a configuration management tool (e.g puppet/chef/ansible). Also, it's far better to have the pubkeys stored in a filesystem location (I.e not

Manage them using a configuration management tool (e.g puppet/chef/ansible). Also, it's far better to have the pubkeys stored in a filesystem location (I.e not in the users home directory) that the ssh daemon has read access to, and no-one outside of root/config management has write access to.