If you’re on AWS also consider high value add built ins like EC2 instance connect or ssm session manager so you can manage host access via IAM.
Disclaimer: main developer and co-founder here.
We started theoapp [1] in mid 2018 and we introduced it at FOSDEM 2019 [2]. We then launched AuthKeys [3], a company that offers it as SaaS.
From a technical standpoint, we chose a different approach than that described by this thread's O.P. More specifically we implemented our service as a client/server suite to integrate with the standard sshd authorizedKeysCommand feature. Rationale and more technical details can be found at the links below.
We've been in "stealth mode" until now (this is our very first public post!), while running the service with selected customers since December 2019.
Recent developments will soon allow us to widen the product’s offer with a self-hosted solution of AuthKeys.
Feedback from the HN community is more than welcome: we'd like to hear whether the website is effective and clear enough on explaining how AuthKeys works [4]. We realized the topic comes with a certain degree of complexity for some potential users while others really want to quickly spot how the internals work and how we managed to make it secure to trust and easy to use.
We’ll be happy to answer any questions on the matter, and to offer promo codes to HN readers in case you wish to give it a go.
[1] https://github.com/theoapp/ [2] https://archive.fosdem.org/2019/schedule/event/theo_keys_man... [3] https://authkeys.io/ [4] https://authkeys.io/how-it-works
[1] https://linux.die.net/man/5/sshd_config [2] https://news.ycombinator.com/item?id=24620842
It would be really nice to have a solution to this problem that doesn't require the user to go to first principles involving Alice, Bob, and Charlie.