“None of these issues are actually inherent to SSH.”
Trust-on-first-use host keys, authorized_keys files nobody prunes, and ex-employees whose keys still work are all problems with public key auth, not SSH itself. Certificates expire on their own and a CA signs who gets in. OpenSSH has supported this for over a decade. The post is also an ad for smallstep’s certificate authority, but the argument holds without buying anything.