This is definitely interesting. I'd be interested in a functional comparison with ssh using kerberos. Is the difference that each host can be totally independen

This is definitely interesting. I'd be interested in a functional comparison with ssh using kerberos. Is the difference that each host can be totally independent? Does this project require a separate certificate management system? Perhaps you could use IPA or similar for your everyday machines, and HIBA for rarely accessed computers that you don't want in your domain.