What is the use-case here, that isn't better served by simply automating the signing of ssh server certs (and user certs)? This is exactly what this tool does.

What is the use-case here, that isn't better served by simply automating the signing of ssh server certs (and user certs)? This is exactly what this tool does. We leverage our existing PKI to request the signed certificates. mcpherrinm is planning to publish the design doc, it might help clarify things. [...]shifting work around without really simplifying the work flow all that much. Sharkey currently solves one problem and does it well: removing the trust on first use prompt. When you have thousands of servers, you run into the prompt on a daily basis. In addition, some virtual machines get re-imaged on a regular basis. As a result, you train engineers to ignore the TOFU prompt and also ignore the fingerprint changed warning in some instances. The certs can be short lived. It's not strictly equivalent to a revocation system, but in practice it seems short lived certs work well. [...]expired, forgotten, compromised and lost public keys in "authorized_keys" Sharkey does not address any of these. We already have automation around our authorized_key management.