Thinking about it you make it a good point. How you do it is "central" but much less of single point of failure than something like LDAP. It would require a pre

Thinking about it you make it a good point. How you do it is "central" but much less of single point of failure than something like LDAP. It would require a pretty contrived scenario to go undetected for an extended period that could be slightly more likely depending on how often you rotate keys. It would be nice if OpenSSH supported CRLs.