> I'm a fan of SSH certificates and cannot understand why anyone would set up certificate authentication with an external third-party CA. I think the sales pit

> I'm a fan of SSH certificates and cannot understand why anyone would set up certificate authentication with an external third-party CA. I think the sales pitch for these sorts of service is: "Get an SSH-like experience, but it integrates with your corporate single-sign-on system, has activity logs that can't be deleted even if you're root on the target, sorts out your every-ephemeral-cloud-instance-has-a-different-fingerprint issues, and we'll sort out all the reverse-tunnelling-through-NAT and bastion-host-for-virtual-private-cloud stuff too" Big businesses pursuing SOC2 compliance love this sort of thing.