“If a user has root access via the certificate on a server”

1. If at all possible, avoid giving anybody (even yourself) root access.

2. You can move the authorized keys files to a different location. See https://serverfault.com/questions/313465/is-a-central-locati.... That’s not hacker-proof against users having root access, but will prevent users of good will from doing the wrong thing.

3. Depending on OS/file system, you may be able to make .ssh/authorized_keys immutable, even for root, on the server. For example, FreeBSD has the “system immutable” flag. Files with that flag set can only be modified after booting in single-user mode (https://www.techrepublic.com/blog/it-security/freebsd-file-f...)