Worth noting that newer OpenSSH supports AuthorizedKeysCommand, which will call out to an external tool for key data. Obviously this doesn't solve all problems

Worth noting that newer OpenSSH supports AuthorizedKeysCommand, which will call out to an external tool for key data. Obviously this doesn't solve all problems, but it does provide a middle ground between flat keyfiles and rolling your own daemon.