We use smallstep in production and it is great. We have Okta groups that control who gets access to what in our infrastructure. This makes onboarding and offboarding users to our large number of production deployments super easy. If anyone has pain around managing shell users or they want to use SSH certificates without the pain of running your own CA definitely check out smallstep.