> hmm, where do you store the CA private key? On another device. > We're just going around in circles Depends on attack vector. Both solutions store private

> hmm, where do you store the CA private key? On another device. > We're just going around in circles Depends on attack vector. Both solutions store private key in HSM and hence protect against "attacker gains access to local memory/storage". However, ssh certs allow key to be "regenerated". HSM'd keys are subject to "device got lost/destroyed" attack, HSM'd certs are subject to "CA got compromised". Pick your poison.