OpenSSH actually has native support for using certificates (in a custom format, not X.509), so if you're building out PKI with SSH in mind it's probably worth going that route.

See: https://www.digitalocean.com/community/tutorials/how-to-crea...

Netflix's BLESS project is a neat example of how to build a simple OpenSSH PKI using AWS primitives.