Stop relying on public keys to hold your entire security strategy together

Technical Briefing | 9/4/2026

We all started by dropping a public key in authorized_keys and calling it a day. It feels secure because it is better than a password, but eventually, you realize that managing hundreds of individual keys across an entire fleet is a recipe for disaster. When an engineer leaves, do you actually rotate all those keys, or do you just hope nobody notices? Most shops end up with keys that are essentially permanent backdoors.

Why static keys are a liability

The fundamental problem is that static keys lack context. A key doesn’t know if it’s currently authorized, when it expires, or even who is holding the private half. When you bake these into your golden images or push them via legacy shell scripts, you are creating a massive attack surface. If a laptop gets stolen or an SSH agent gets dumped, you have zero visibility into who is connecting until you parse through logs that are likely already being rotated or overwritten.

ssh-keygen -t ed25519 -f ./short_lived_key -C "temp-access-$(date +%s)" -N "" && ssh-add ./short_lived_key

• Stop trusting individual keys and start trusting a centralized certificate authority
• Enforce short TTLs so that stolen credentials have a self-destruct mechanism
• Audit who connected and when by logging certificate serial numbers instead of just IP addresses

Moving toward ephemeral access

The right move is to treat SSH like a transient token rather than a permanent identity. By using SSH Certificates, you can sign a key for a specific user for a specific time window. The server doesn’t need to know about the user; it only needs to trust the CA that signed the certificate. This removes the need to maintain authorized_keys files across your infrastructure, and it means you can revoke access at the IDP level without touching a single production server.

If you are still distributing keys with Ansible or Terraform, you are doing it the hard way. Look at how your access workflow can move away from static identity. Next time a developer asks for root, don’t ask for their public key. Point them to the toolchain that issues certificates, and watch your security audits become significantly less painful.