> They now need to get IT to distribute the public keys to a set of hosts, where the full list is possibly not known by any one person If the team responsible

> They now need to get IT to distribute the public keys to a set of hosts, where the full list is possibly not known by any one person If the team responsible for server security isn't able to identify all the servers they're responsible for, you've got far bigger problems than SSH certificates are going to solve.