AFAIK a SSH CA can be a good solution for this.

See e.g. https://news.ycombinator.com/item?id=16615307 for some more info.