Classic "garbage in, garbage out"
371 karma · joined August 16, 2016
Your rebuttal again is how expensive it is to fly. Some would almost say, prohibitively high?
You could make keys valid for only a minute and it wouldn't add any security, as only seconds are needed for a malicious action to take place.
I'm also not sure it's easier to "lock down access to your bastions" and wait out the certificate expiration instead of having a certificate revocation database. Although OpenSSH does not provide a mechanism to distribute the revocation list it seems trivial to add a certificate to the revocation list and distribute it in an automated fashion.
Lastly, since you have to both lock down hosts and wait out the expiration, does that not constitute a fail-open system? I really don't think an expiration date mechanism makes this a fail closed system. Either method requires manual intervention upon compromise.