(disclaimer, I was a founder of ScaleFT - acquired by Okta)

This is exactly why many customers use Okta's Advanced Server Access: https://www.okta.com/products/advanced-server-access/

It does certificates as a credentialing mechanism, but also full separate accounts, lifecycle management of accounts and sudo files.