SSH CAs are not incompatible with my argument! An SSH CA can sign short-lived certificates for just-in-time generated keys.