sounds like just adding complexity over traditional method of OpenSSH + key distribution (either via configuration management or ldap)

and now, bugs

Adding complexity would imply you're doing both. In this case it would be more correct to say you're trading the complexity of key distribution and access control via keys for the complexity introduced by tailscale ssh.

yep, this was obvious from day one.

No, it doesn't sound like it. Tailscale reduces complexity. It literally is key distribution with an ACL.

I work at a finance org with hundreds of engineers and thousands of technical users. You cannot be compliant with finance compliance frameworks using OpenSSH without audits and traceability and some source of identity management. That is exactly what Tailscale (or an alternative product) provides.

> and now, bugs

If you do it yourself, you now own that software entirely. Your comment lacks understanding of the complexity of real world scenarios.

You just need to implement an SSH CA. You can roll your own. Vault has an enterprise one. StepCA is suitable for smaller orgs.

All the benefit of the core SSH protocol as it's just key signing. It's honestly underrated.