That's correct — The user obtains a short-lived SSH certificate (signed/issued by a CA).