It's worth noting that Conjur's SSH solution is built around familiar unix tools like pam-ldap and AuthorizedKeysCommand. Why reinvent the wheel?