Regarding your idea of short lived root SSH certificates. Netflix BLESS[1] is an implementation of this, but it relies on AWS Lambda. Thers's also an open sourc

Regarding your idea of short lived root SSH certificates. Netflix BLESS[1] is an implementation of this, but it relies on AWS Lambda. Thers's also an open source re-implementation without this dependency, called CURSE[2]. [1]: https://github.com/Netflix/bless https://github.com/Netflix/bless [2]: https://github.com/mikesmitty/curse https://github.com/mikesmitty/curse