TrustedUserCAKeys on the target host is the whole trust model, and that is what makes custody non-negotiable [2]. One private key can grant access to every host in the fleet, which is why keeping it on a laptop is described as an incident waiting to happen [3]. So it moves into an HSM or a KMS, and signing stops being a local operation and becomes a dependency with its own availability [4]. Certificates are issued with short validity, so that operation runs constantly [2], which is how you arrive at the author's own description of a system sitting in the path of every production login [9]. That is my reading of why he puts the outage runbook inside the two-to-four week custody estimate rather than somewhere after it [4].
The money is arithmetically consistent, which is worth confirming before you quote it at a review. Two to three engineer-quarters is 0.5 to 0.75 engineer-years [1]. At the bottom of both ranges, 0.5 times $150k is $75k; at the top, 0.75 times $200k is $150k, which reproduces the published $75k to $150k exactly [2]. The ongoing figure works the same way: a tenth of an engineer at $150k is $15k, a quarter at $200k is $50k [3]. Widest honest bracket, no padding hidden in it. The ratio is the part I would carry into the meeting. Two to three quarters is 26 to 39 engineer-weeks, so the week everybody estimates confidently comes to between 2.6% and 3.8% of the total, and it is also the only part of the project that produces a demo [4].
Three things have to hold for those numbers to be yours. Your loaded engineer cost sits in the $150k to $200k band [12]. You actually intend to ship IdP integration and an approval path rather than living with manual approval indefinitely [5]. And you count session audit plus Kubernetes and database access as in scope, because the quarter-of-engineering figure excludes them: audit roughly doubles it, and covering clusters and databases turns the thing into a small internal product with permanent maintenance [10]. If the second condition fails, the build stalls short of completion, and that stall is its own way of blowing the estimate [14].
The disclosure does work here. The estimate comes from someone who sells the alternative [1], and it is one practitioner's judgement rather than measured data from a sample of teams. What makes it usable anyway is which line items grow: the approval path that has no launch date [5], and the on-call rotation for a login-path service [9]. His explanation for why the 80% version persists is the part I would not argue with, that internal tools are funded by attention and attention moves [15]. His gate is four conditions, build if two hold [13]. In my context the audit requirement settles it before the arithmetic does. If an auditor wants per-command history, the comparison is a CA plus a session recording system against the product, and the recording half is the harder engineering [7].
