[abbbi]

there is the AuthorizedKeyscommand feature that allows for a command to fetch keys not yet existing on a system. Gitlab uses it to fetch keys from a database, for central user and access management. They also ship a own sshd implementation which does kinda neat lookup things for very big databases.

theres already projects solving central ssh key management, for example:

https://github.com/ierror/ssh-permit-a38 (distributes via authorized keys)

https://github.com/netlore/OpenAKC

https://tenshidev.medium.com/centralized-ssh-authentication-...

and

https://docs.gitlab.com/ee/administration/operations/fast_ss...