How does having an SSH CA help you roll out detailed access to hosts/ports/services with fine grained permissions via access control lists derived from your identity provider? How do you make sure you're giving out least privileges with a compliant onboarding/offboarding and audit process? That is where the real meat is.

If you've solved all these problems yourself at your org: congrats, you re-implemented Tailscale with a bespoke solution that takes orders of magnitudes more $ to maintain and audit regularly than just buying an industry trusted solution.

Tailscale is, all things concerned, really cheap. It costs less at my large org than a single engineer. Doing it ourselves would take a team. Maybe two. Once again, HM primarily comments from a naive engineer's perspective, not from a leadership view.