Ideally, the decrypted CA key should never be written to disk.

Ideally, we could have a setup that requires k-out-of-n admins collaborating to sign a host key.
This way, the CA key is never exposed to a single machine.

While the crypto for this exists, the tooling does not :-(

We should be able to revoke keys when needed.

Unfortunately, revoking the host keys involves having people update their copy of the KRL (key revokation list) periodically.
While this is very easy on the shell servers (keep a copy of the KRL in /etc, put a configuration directive in /etc/ssh/ssh_config for the client to take it into account), we cannot expect all users to do the right thing. As such, we should only issue certificates with limited validity period (say, 4 months) and handle renewing the certs as needed.

This requires:

• properly saving the certs (for later revokation);
• writing a script to drop expired certs from the KRL;
• creating a new cert if the old one expires within some threshold.