Actually a ssh key-rotation could be scripted in a cron-job and be completely transparent to the user...

Every X days generate a new RSA key pair, connect to all the hosts and replace the public key matching the previous one in the ~/.ssh/authorized_keys

Is there any issue with this solution?