For (possibly) smaller scale I wrote a self-service SSH CA: https://github.com/nsheridan/cashier