SSH actually supports the usage of certificates that you can use to sign individual keys with a finite lifetime and key revocation. For some reason, very few people know about this and assume SSL/TLS whenever you say "certificates".

You can read about this in the `CERTIFICATES` section of ssh-keygen(1).