If you have a large enough installation to make use of such a thing you should absolutely not go distributing keys in this homecooked way. Either you already h

If you have a large enough installation to make use of such a thing you should absolutely not go distributing keys in this homecooked way. Either you already have an authentication infrastructure in place, such as Kerberos, in which case you should absolutely use that for SSH as well and not roll your own. If haven't, and your problem concerns mainly SSH, you should absolutely use the PKI mode of OpenSSH unless you have some reason not to. It has existed since 5.3 and works like you would expect, with a central CA and CRL. Start with a good overwiew such as http://blog.habets.pp.se/2011/07/OpenSSH-certificates http://blog.habets.pp.se/2011/07/OpenSSH-certificates (or some other Google hit), then consult the official documentation for a few more details.