What do you do now if someone leaves? Remove that person's key from all 50 hosts one at a time?
Or, at the very least, you use tmux with sync panes or csshx - and log into all 50 hosts at once, and then you can issue one rm / scp command if you are still doing things manually.
Are my guys going to spend 5 minutes every morning making and pushing keys?
What if my hosts auto provision themselves and there are 5 new hosts every morning?
Am I going to make keys as part of infrastructure deployments and push them back to the workstations and update other peoples ssh configs?
I'm just saying if you've worked at scale, you'll realize that a key per box won't scale. I mean, anything can scale if you put enough effort into it. But the chances of disaster in lack of access or security breach, from over complication is way to high here.
Automating bad processes just makes it easier for them to fuck you.
Even with config management this won't scale past about 2 or 3 people and 10-20 boxes.
Central auth is an option I guess but I think the better way to go would be a 2 factor with the key and hotp.
OpenSSH can also be used in a PKI fashion, where you use certificates instead of known_hosts and authorized_keys records. It's quite all right, but it comes with the same problems a full PKI does as you need to keep track of when the certificates expire. You also need a way to distribute CRLs so you still need configuration management.