Great pros and cons analysis honestly; I would say though that this is isn't buying into the model of Infisical SSH specifically as much as it is just changing the overall approach from SSH public key authentication to SSH certificate-based authentication which has been available for years; Infisical SSH is more-so there to provide the tooling to more easily implement this approach.
Regarding the point on users generating their own keys, I'd say this would still be possible — You can have an SSH CA sign/issue a certificate for an existing key pair.
Comments
Great pros and cons analysis honestly; I would say though that this is isn't buying into the model of Infisical SSH specifically as much as it is just changing the overall approach from SSH public key authentication to SSH certificate-based authentication which has been available for years; Infisical SSH is more-so there to provide the tooling to more easily implement this approach.
Regarding the point on users generating their own keys, I'd say this would still be possible — You can have an SSH CA sign/issue a certificate for an existing key pair.