I completely agree, but (1) most identity providers don't issue SSH certificates, and (2) a lot of services won't accept SSH certificates for auth. But we're actually using this approach for access to some of our internal components (we issue a short-lived cert that logs you in as a generic user but still gives an audit trail), for the advantages you describe.
Power management, mobile and firmware developer on Linux. Security developer at nvidia. Ex-biologist. Content here should not be interpreted as the opinion of my employer. Also on Mastodon and Bluesky.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: certificate model might still be better
Date: 2022-09-22 10:51 pm (UTC)