Signed certs for ssh is IMHO the best solution for managing this problem in larger orgs. Nice to see Facebook published their process around it.