Question: Let's say I want to set up a poor man's authentication scheme for a simple network service.

I don't want to bother with username/password authentication, for simplicity I just want to have a list of public keys in my application and anyone who can prove they are the owner of that key can use my service.

For the purposes of my application it would greatly simplify the authentication process since all my users are on the local network and they all use Unix. Anytime I onboard a new user I can just ask them for their ssh public key.

Is there a simple way to reuse the mechanism involved in ssh public key authentication in a non-ssh application? This is question is intended to be language agnostic.

Answer: 
A dirty hack from top of my head: could you wrap the application so that it would create an actual SSH tunnel from localhost to your server, and use that for ?
Assuming you are talking about a web based application. What you are really looking for is X.509 Client certificates (1.3.6.1.5.5.7.3.2). This will allow you to identify a user individually to your application.

These face the same issues that are usually faced when looking at key distribution. Which is generally considered a hard problem.

If you wanted to head down this road here is what you would need to do.

* Generate a root certificate (once)
* Setup web server with appropriate modules to parse the certificate (nginx/apache)
* Generate a certificate for each user (openssl)
* Download cerificiate from centralized server. (maybe use their ssh pub key here)
* Install the x509 cert locally (OS Dependent)

On the server side, you would need to process the cert as part of the web-server (nginx or apache should have modules to do this) and then pass the name onto your application as a header field which you can then process internally.

This is a much better security solution than usernames and passwords, however is complex because of the key distribution issue. Most people wouldn't bother since in most applications it is easy enough to integrate logins with LDAP or radius.