(untitled)

Obviously you need some trust binding - in the SSH key case that's implicit because the pubkey is a functional element and useless without the private key so you can't fake that, but with some indirection you can have a trusted service effectively embed metadata into an OAuth token that gets signed by an IdP and this seems generally easier than implementing your own arbitrary PKI