This is interesting. I wrote a service for issuing user ssh certs but it doesn't manage host certs.

https://github.com/nsheridan/cashier