Hacker News Reader

I don't know that I disagree with the broader point here, but long-lived certificates are what you don't want.

Not GP, but I'd assume they talked about the root cert? You don't want to roll out a new one every other week ;-)

Yeah, the root is long-lived. The ones you issue to SSH to a machine are short-lived, because they're not stored in something like Vault.