Given the extremely bad consequences of the authentication server&#x27;s failure and the load it might be under for a fleet of 1000s of servers, that would probably require a fairly sophisticated clustering&#x2F;HA approach. That is a <i>lot</i> of effort to spend compared to writing ensure =&gt; present and ensure =&gt; absent for a bunch of SSH keys in Puppet, which anecdotally seems to be what a lot of major companies do.