Using certificates for SSH authentication

> For example, a company might store the public keys of all its employees in a secure database and then automatically issue a new one-day certificate to employees every morning. The employees can even retrieve it from an unauthenticated web server.

Or, throw in security keys and online signing and you get: Resident certificate on security key support + password challenge-response + password challenge transcript must be signed by the key + effective screen locks => 2FA assurance for SSH