What's the best way of dealing with the chicken-and-egg problem of initial login when using PKA? Should login be denied until the private key is uploaded via something other than ssh?
Right now my big problem is that the channel for the public key is email, which is no good.
On larger deployments I've always put the ssh pubkeys for authorized users in a package that is installed when the server is installed.
The only place I know of that gets this right is Amazon, who stands it up with a key (admittedly one of theirs) that they force you to download before you can connect the first time.