Well that's the thing: SSH has recently gained support for signed public keys - i.e. x.509 style certificate authorities. Outside of that you have things like monkeysphere doing the same with GPG, or simpler things like LDAP scripts which just check the key against LDAP (Hashicorp Vault does something similar).

But it's why I'm skeptical the UI is substantially improved: the simplest UI for VPN tends to be pre-shared keys - because everything more complicated simplifies to that interface "somehow everyone needs to agree who's allowed in" - and differs to SSH because SSH has more of a one-way contract "let this connection in, but I can't make the same connection back".