I understand why they don't talk about the CA functionality in OpenSSH (they want to sell their own product after all), but OpenSSH supports CA-based certificat

I understand why they don't talk about the CA functionality in OpenSSH (they want to sell their own product after all), but OpenSSH supports CA-based certificates out of the box, which makes it easy to generate auto-expiring SSH credentials. Then again, with a CA-based approach the root key becomes the golden key and needs to be protected, which might still be easier than protecting individual keys though. I recommend using a bastion host through which all SSH connections go and to use a DevOps tool like Ansible to automate certificate/key placement on every single host. In addition, if you have a trusted network that people log in via VPN you should also limit SSH connections to the bastion host to addresses from this network, which will make it harder again to use stolen credentials. Finally, only a handful of people should have such credentials, most maintenance should be performed in an automated way via DevOps tooling.