Yea we like certificates at smallstep. We’ve got a couple[1] other[2] posts[3] that cover them pretty well. Should have probably made a more prominent mention though :).

[1] https://smallstep.com/blog/use-ssh-certificates/

[2] https://smallstep.com/blog/diy-single-sign-on-for-ssh/

[3] https://smallstep.com/blog/smallstep-ssh/