[bkmeneguello]

I've been using SSH certificates for a while with great success. The only downside, in relation to SSM, is to have to manage your keys an CA, but it worth to avoid vendor lock-in.