Some netflix engineers have given some pretty good talks about SSH certs.

There are a few floating around, I think this is one of the good ones: https://www.youtube.com/watch?v=JwLGsWYVjqU