user-ca-rotate.sh

# curl -f >> onto authorized_keys
# grep a_k for certs
# if more than two lines
# sed out the first N of them

curl -sf https://my-cert.pub >> ~/.ssh/authorized_keys &&
  sed -i '' '1!G;h;$!d' ~/.ssh/authorized_keys &&
  awk '!/^cert-authority / || ++n < 3' ~/.ssh/authorized_keys > ~/.ssh/authorized_keys.tmp &&
  sed '1!G;h;$!d' ~/.ssh/authorized_keys.tmp > ~/.ssh/authorized_keys &&
  rm ~/.ssh/authorized_keys.tmp &&
  chmod 600 ~/.ssh/authorized_keys