Once it reaches this level of complexity, one might consider setting up some kind of centralised authentication system. You can hook openssh to pull public keys

Once it reaches this level of complexity, one might consider setting up some kind of centralised authentication system. You can hook openssh to pull public keys off openldap, and possibly add some additional checks on it (like group membership). This way when a developer leaves the company, you just remove their entry in the LDAP DIT and all and every access is removed.