You just need to implement an SSH CA. You can roll your own. Vault has an enterprise one. StepCA is suitable for smaller orgs.

All the benefit of the core SSH protocol as it's just key signing. It's honestly underrated.