SSHCA now supports issuing user certificates. It uses OpenID Connect to authenticate requests, and issues certificates based on the user's ID token.
[sshca] is a simple web service I wrote to automatically create signed SSH certificates for hosts' public keys. It authenticates hosts by their machine UUID, which it can find using the libvirt API. [sshca]: https://git.pyrocufflink.net/dustin/sshca
Dustin