> The certificate would just be another layer of indirection. I fail to see how that would be a meaningful change. That certificate would only be issued after

> The certificate would just be another layer of indirection. I fail to see how that would be a meaningful change. That certificate would only be issued after you've gone through SSO or some other certificate management process and it would have a defined expiry period, maybe even as short as a few minutes. It is a meaningful change. When using key based authentication, as long as you had your public key in the authorized_keys file on the server, you would be able to login without issues, even if your keypair is compromised. With certificates, even if your keypair is compromised, you wouldn't be able to login to that server because you'd have to compromise the SSO/MFA authentication step as well, which adds another layer of meaningful security in the process.