Hacker News Reader

there are a couple of nice SSH setups you can achieve with RADIUS and our friends at https://www.foxpass.com/

Vault also has SSH backends that you could find useful

My thoughts exactly, and it has years of production battle hardening + crypto validation.

Kerberos is really complicated. I am currently setting up LDAP, and have it storing SSH keys. Which is a far simpler setup.

We do both. Ssh keys are the backup if there's ever a kerberos outage.

Also make sure to deploy the ssh keys somewhere the users can't write for extra security. Don't allow them to control their own authorized_keys files! :-)