Tailscale is a VPN built on top of wireguard that identifies you at the network level. This means that as long as you are connecting through your tailnet, you can configure your machines to let you in without an auth challenge (or with a 2fa challenge) through PAM modules. Afaik the auto-login part is beta but you could also run a second sshd that only ever listens to the interface of the VPN and lets you in with no password. Tailscale allows you to set network-level access permissions, per user (though having more than 3(?) Users costs money) and support logging in through ubikey-like keys or oauth.

Or, you can set up a git repo that hosts your Public key, and Cron jobs that pull it every hour/day/whatever. It’s safe to publish your Public key in this manner, and if you somehow lose the private key you may simply update the repo and wait for the change to propagate.

Or, Ansible is particularly well suited to public key management, but it’s not really automated (you have to run it manually and it connects to every server) so you may end up in a situation where you would like the server to pull valid keys by itself and can’t log in manually until it has done so. If that is acceptable to you, Ansible also enables you to manage a lot of your infra (automatic installs and enabling of common daemons such as monitoring comes to mind).