Setting "AuthorizedKeysFile /dev/null" is a handy way to disable public keys while leaving centrally-specified certificate keys active. Unfortunately it isn't supported by Match.
Created attachment 1862 [details] /home/djm/more-match.diff Add more options to match, including AuthorizedKeysFile
Created attachment 1863 [details] /home/djm/more-match.diff Add more options to match, including AuthorizedKeysFile
Created attachment 1876 [details] Also update the list of options that work with Match in sshd_config(5) As an aside, I wonder if it would be better to list the options that work with Match one-per-line, as is done for the description of the -o switch in ssh(1). That seems more readable to me.
applied - thanks. This will be in openssh-5.6.
Move resolved bugs to CLOSED after 5.7 release