I suppose they might want to stop issuing client auth certificates because it means anyone with a PKI-signed cert could potentially authenticate as a client to a server. With PKI being a series of trust relationships among CAs, there's effectively no control over what gets accepted vs. rejected. I suppose from that perspective only private CAs make sense.

If you want to try using a private CA for x509 certificates to do SSH client authentication, I know of a couple solutions that make it easy to do:

Smallstep: https://smallstep.com/docs/tutorials/ssh-certificate-login/

Infiniscal: https://infisical.com/docs/documentation/platform/ssh/overvi...

You can also do it the hard way. For example, here's how it can be done to SSH into Cisco network gear: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9...