Disclaimer: I work at Gravitational, one of our engineers is the author of the article. The added complexity is indeed significant, that's why we built Teleport

Disclaimer: I work at Gravitational, one of our engineers is the author of the article. The added complexity is indeed significant, that's why we built Teleport [1] which is much, much simpler open source alternative to OpenSSH for such use case (the blog post does not mention Teleport because it was written for OpenSSH users). But generally, certificates have a number of advantages: they expire quickly (you can have one-shot certs), they contain your full name, email address, or whatever you wish via metadata, this allows to implement RBAC on top of SSH. They address "trust on first use" issue, and they're easy to synchronize with other protocols, i.e. you can have the same CA issue certificates for both Kubernetes and SSH (with identical RBAC rules). When implemented properly, they're actually easier to use. The whole world uses certificates to do online banking and shopping, there's no reason not to have the same seamless experience for SSH. [1] https://gravitational.com/teleport https://gravitational.com/teleport