[blueflow]

The certs are just an alternative to managing the authorized_keys server-side. That's it. What you said about MFA and not getting long-term secrets is some extra thing on top of it and not invalidating your parents point.

[tptacek]

No, that's not true. SSH keys are long-lived secrets, and certificates often deliberately aren't.

[blueflow]

This is not what it is, this is how you specifically use them.

[tptacek]

I understand what you're trying to say, but "The certs are just an alternative to managing the authorized_keys server-side" is just not correct. Certs can do things plain authorized_keys can't.