[nsheridan]

I use them for personal machines, and have deployed them in the past in work environments. A few years ago I wrote a CA which can exchange oauth tokens for signed keys: https://github.com/nsheridan/cashier

Auth is handled in a browser e.g. by Google, and the CA will sign a key and return a cert with a valid token.