[webvictim]

This is definitely the premise of what I was going for with the post. I'm a firm believer in the idea that short-lived certificates which expire by default are one of the best ways to provide access to infrastructure, and enforcing that access comes from a limited list of bastions gives you an easy choke point to withdraw access as desired when you need to.

[sytringy05]

Isn't there a netflix ssh CA that does this?

[V-eHGsd_]

yes, it's called bless.

https://github.com/Netflix/bless

there's also cashier

https://github.com/nsheridan/cashier