Besides the usual public/private key system, OpenSSH supports a less-used system called user certificates. User certificates achieve the same purpose as your n

Besides the usual public/private key system, OpenSSH supports a less-used system called user certificates. User certificates achieve the same purpose as your normal key but instead of pre-installing your public key on the server, you present a certificate during authentication and the server checks that it's signed by a trusted authority - it's more or less a PKI similar to that used for HTTPS, etc. One of the key advantages of this approach is that the CA can enforce limits on the key, such as validity periods and disabling SSH features like port forwarding, binding a certificate to only run a particular command, or only allowing it's use from a specific IP. BLESS appears to be a piece of infrastructure for autonomously signing these certificates - on it's own that gives you benefits like a proper audit log, but it seems that it's real purpose is to enable an SSH bastion host[0] to generate ephemeral keys for the servers it accesses. [0]: http://blog.scottlowe.org/2015/11/21/using-ssh-bastion-host/ http://blog.scottlowe.org/2015/11/21/using-ssh-bastion-host/