I'm just taking the article's main point at face value. Certificates help with enabling access quickly (fast onboarding) but revocation needs every server to be

I'm just taking the article's main point at face value. Certificates help with enabling access quickly (fast onboarding) but revocation needs every server to be informed about the change, since OpenSSH doesn't do OCSP. If a single file change is untenable at scale or volume, how does your organization manage version deployments, or even something small like an emergency reconfiguration, without collapsing or having to cope until "patch tuesday"? What you describe sounds untenable to me.