[vbernat]

There are not many network vendors. Check the link in the first footnote for an example how Cisco, the leader in the field, makes it difficult to deploy SSH keys. This is getting better. For example, Juniper (another network vendor) now supports SSH certificates.

[RedShift1]

I have no idea what's going on in the footnote, but deploying SSH keys on Cisco equipment is like 3 commands (conf t, user x, ssh something something) to deploy public keys, not hard at all.

[bnny]

It's been a few years, but this requires manually deploying keys and adding/removing users on all your devices. Most use TACACS+ and/or Radius to centrally manage users, which don't support keys in that way (or at least didn't the last time I worked with them.)

[vbernat]

There is an implementation with an extension: https://github.com/MarcJHuber/event-driven-servers/wiki/TACA.... But I don't know if there are any supported clients.

Another possibility would be to use CA certificates for authentication and only TACACS+ for authorization and accounting. Juniper now supports CA certificates. Cisco may in 10 years.

[vbernat]

Not on IOS XR: https://vincent.bernat.ch/en/blog/2020-syncing-ssh-keys-iosx.... The commands you mention are for NXOS.