[tptacek]

No, that's not true. SSH keys are long-lived secrets, and certificates often deliberately aren't.

[blueflow]

This is not what it is, this is how you specifically use them.

[tptacek]

I understand what you're trying to say, but "The certs are just an alternative to managing the authorized_keys server-side" is just not correct. Certs can do things plain authorized_keys can't.