> How about putting different hosts into groups, and then running a command on the group so that every machine in the group runs the same command?

That can be done with a simple awk/fzf script, which would even allow me to interactively chose the hosts from the ones configured in the ssh config.

> How about managing both hosts and users so that I can easily log into a system as different users for different purposes?

The ssh config already allows doing that:

    Host prod-as-foo
        HostName domain.of.prod.server
        User foo
        Identity File ~./ssh/foo.key

    Host prod-as-bar
        HostName domain.of.prod.server
        User bar
        Identity File ~./ssh/bar.key

> How about adding some security features to make key management more secure than the standard "everything in the .ssh directory" strategy?

IdentityFile keys can be setup to be symmetrically encrypted, requiring a password on use.

The keyfiles can also be loaded via `ssh-agent(1)`, allowing to directly use non-local keyfiles (source: `man ssh`)

> Maybe add some SCP/SFTP features so that moving files from host to host is easier.

Both `scp` and `sftp` already use the ssh config file.