So, you're not doing it wrong if you have Kerberos providing actual SSO (for "all" services) since before certificate authN was available. You need GSSAPI anyh

So, you're not doing it wrong if you have Kerberos providing actual SSO (for "all" services) since before certificate authN was available. You need GSSAPI anyhow if you have Kerberized home directories and not typing passwords at ssh. Although you're likely to have LDAP (in which you can store public keys), all you need is the KDC and a simple Kerberos setup on ssh clients and servers. I wonder why anyone thinks you need more. Kerberos tickets and infrastructure are roughly equivalent to using ephemeral certificates as far as I can see. The one reason you might want certificates is if you require FIDO MFA, as I don't know if you can use anything other than OTP with Kerberos implementations. (The hook for "the auth flow" is preauth.)