Hacker News Reader

If you want a really good solution, consider using an SSH CA.

I am, but my question is how to control for people still adding keys in addition to having logged in with a certificate.