Your key is not involved here at all. You can also sign host keys and then trust the CA instead of the host key with TOFU, but as mentioned in the article, the

Your key is not involved here at all. You can also sign host keys and then trust the CA instead of the host key with TOFU, but as mentioned in the article, there's no way to do this without having the user fiddle with their SSH config and I'm unsure how good the tooling for distributing revocations is. Vault has a setup guide, along with the little dance a user would have to do: https://developer.hashicorp.com/vault/docs/secrets/ssh/signed-ssh-certificates#host-key-signing https://developer.hashicorp.com/vault/docs/secrets/ssh/signe...