> SSH certificates are fail-secure

Yeah... no. I think my private key stored on yubikey is harder to steal than session to your OIDC.