Oh yeah, you are better off having a separate but hardened SSH authentication server that is to be consulted by such SSH gateways, just to protect the private k

Oh yeah, you are better off having a separate but hardened SSH authentication server that is to be consulted by such SSH gateways, just to protect the private keys. And use DTLS (two sets of client and server PKI , one for each direction) to guard that link between SSH gatewat(s) and SSH authentication (certificate-based) server. The starting point of all this: https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand/ https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand...