I always found this such an annoying step to implement. We've switched to certificate based authentication on SSH - no more moving around public keys. Really simplified the whole process!
What do you actually do, and how is it better?
What public key is installed where on the servers? What self-serve system where generating certs how and in what form do users get them and what do they do with them?
And how is the user authenticating to the self-serve system - username/password? And why can't they just do that to the SSH server?
The user uses the SSH key as normal. The server checks that if key is signed.
The self-serve system uses the single-sign-on system for the company. The SSH server can't do SSO, maybe can do LDAP, but it is giant annoyance to set it up. A lot SSH use assumes that using key and doesn't support username/password.