This is already a solved problem and ssh provides the solution. If you have a fleet of machines, you better be using config management to manage them. And you s

This is already a solved problem and ssh provides the solution. If you have a fleet of machines, you better be using config management to manage them. And you should be pushing out the public key that's on the device you use for remote access to all the machines using that config management. There isnt "a keypair for every node". And if you're talking about managing host keys, this is solved with host certificates signed by a local CA, the public key of which you put in your known-hosts file. This "short pitch" says there's a problem where none exists.