Hacker News Reader

Sounds to me like what is needed for a managed root-server. Actually it's kinda cool because you can enjoy timely upgrades, security fixes and response to ddos attacks while at the same time you also have the flexibility to install needed software without going through a change request workflow...

This is an opt-in process, not an opt-out. They don't have authorized keys on your server by default, only instructions to add them if needed.

Unless it has changed recently, it's opt-out. The instructions are mostly for re-adding the key if you have removed it.

A SSH private key is just some bytes. Once you have access to it, you have access to it forever in the future. RSA doesn't care if you are an "authorized employee".

A static SSH key for a single human is already risky over a long time period, but for a key that is shared between multiple humans... wow.