Your scheme could probably be implemented using certificate based SSH: Your users log onto a CA which gives out user-certificates with a specified lifetime, the

Your scheme could probably be implemented using certificate based SSH: Your users log onto a CA which gives out user-certificates with a specified lifetime, they copy that to their desktop-machine(s), or maybe add it to a ssh-agent like intermediate key-storage and can do their days work. Tomorrow, they'll have to get new certs (automatically, after authenticating to the CA using appropriate means). Here's a tutorial showing cert-based ssh auth: http://neocri.me/documentation/using-ssh-certificate-authentication/ http://neocri.me/documentation/using-ssh-certificate-authent... Obviously with secure key storage (smart-card) prohibiting accidental loss of the private key, and a working cert-revocation infrastructure it's not necessary in the first place.