Do you know how the sysadmin organizes himself? Is there a process where he gets notified of leaving engineers to remove their keys?

edit: typo

This works up to some point. It works if you have a small number of servers, a small number of people, and 'who can access what' is simple and obvious, but as soon as one of these conditions is exceeded, it becomes unmanageable.