Like I said, it's been a few years so maybe things have changed since then. But if I recall... x509 supports all of the things that ssh key file format does ..

Like I said, it's been a few years so maybe things have changed since then. But if I recall... x509 supports all of the things that ssh key file format does ... and also a lot more. ssh supports x.509 too so that makes it "easier". When you use `ssh` to connect, you'd specify -I and point to the private key and it will automatically try to find a certificate file whose name is identical to the identity file but with "-cert.pub" appended (see `man ssh_config`). There's another option to explicitly specify the key certificate file `CertificateFile` but there's no short-argument version so you have to use `-o CertificateFile [filename]` or add that to your `~/ssh/.config` file. You'd need to use `openssl` command (or, of course, any openssl-like command line) to sign the your SSH key. And, of course, openssl doesn't understand ssh key files so you have to use `ssh-keygen` to convert the key to x509 format or else generate the key using `openssl` (but again, at least ssh understands x509 natively so the downside is having the much longer x509 text). And that's quite the arcane part: openssl cli is fucking awful. It doesn't follow normal command line conventions, doesn't have tab autocompletion, and its documentation is obscure/difficult to find, extremely terse, and difficult to even understand if you're not already explicitly familiar with exactly your inputs and outputs. And then there's the whole process of getting your key file signed. At least that process is (in general) identical to having a web SSL key signed -- because the private key is actually identical but the only nominal difference is the format of the file that you normally think of using for it. But the workflow is different because the certificate doesn't get installed to somewhere that a webserver would want. I had ended up creating my own Certificate Authority to test with and that was yet another rabbit hole of anger management.