A certificate doesn't necessarily have to be short lived, although in practice they usually are. The main difference is that with an ssh key, you install the

A certificate doesn't necessarily have to be short lived, although in practice they usually are. The main difference is that with an ssh key, you install the public key directly on the target host. With a certificate, you Just tell the host to trust a CA, and use that CA to sign client certificates.