Disclaimer: I work at Gravitational, one of our engineers is the author of the article. The added complexity is indeed significant, that's why we built Teleport [1] which is much, much simpler open source alternative to OpenSSH for such use case (the blog post does not mention Teleport because it was written for OpenSSH users).

But generally, certificates have a number of advantages: they expire quickly (you can have one-shot certs), they contain your full name, email address, or whatever you wish via metadata, this allows to implement RBAC on top of SSH. They address "trust on first use" issue, and they're easy to synchronize with other protocols, i.e. you can have the same CA issue certificates for both Kubernetes and SSH (with identical RBAC rules).

When implemented properly, they're actually easier to use. The whole world uses certificates to do online banking and shopping, there's no reason not to have the same seamless experience for SSH.

[1] https://gravitational.com/teleport

I second this perspective. It might be useful for a larger org, but for my use case and that of my team, I don't see much value-add, and the added complexity would likely make managing this system more difficult than it is worth.

I've also never had an issue with key management, like the article suggests is common. Maybe I'm not the target audience though.

Is one person a small enough shop? ;) I found it useful for personal systems because it meant that I didn't need to verify keys (user keys and host keys) for every server/laptop combination.