Using certificates for SSH authentication

Right. You need a separate bootstrap user (which actually exists) to trigger user creation. It's a somewhat clumsy solution, but it avoids needing to pre-create every user everywhere.