AD and similar things def help, but it's still hard, especially once your deployment gets big or complicated - at the last place I worked we had tons of linux h

AD and similar things def help, but it's still hard, especially once your deployment gets big or complicated - at the last place I worked we had tons of linux hosts + google cloud load balancers + aws load balancers + a tiny AD domain + various others. I think once you hit a certain size, it's incredibly hard to keep homogeneity. Leaf keys on HSMs is interesting. Personally, I view HSM and TPM stored keys about having an immutable identity for the device. Leaf keys are usually a bit more complicated - in the environments I work in, leaf keys are often tied to a service, not the host. The short lived nature also reduces the impact of ex-filtration. Anyway, yeah, depends on the deployment and the org.