An SSH certificate authority is what I’d choose for that. Can work with both user keys and host keys. The host certs have a field for demonstrating their hostname; the user certs have a field restricting their username. So, as the certificate authority you have a little more power than what you can distribute via DNS.