I put CA keys on just one machine, and log in to that machine to generate certificates that I use from other SSH-client machines