Zero-Trust SSH Blueprint Uses FIDO2 Keys and Certificate Authority to Kill Static Keys

A technical blueprint published on DEV Community outlines a zero-trust SSH access model designed to replace traditional static public key management across server fleets. The approach combines FIDO2 hardware tokens, such as YubiKeys, with ed25519-sk key pairs that bind private key material to a physical device and require a PIN and touch to authenticate. A centralized, offline SSH Certificate Authority signs user access requests and issues short-lived certificates valid for only eight hours, eliminating the need to manually manage authorized_keys files on individual servers. This architecture reduces administrative overhead and shrinks the blast radius of compromised developer workstations by ensuring no long-lived credentials persist on target machines. Revoking or granting user access requires no changes on the servers themselves, as trust is managed entirely through the central CA.