Zero Trust SSH Access Management using HashiCorp Vault

Act as an Infrastructure Security Engineer. Design a radical, Zero Trust SSH access workflow engineered to completely eradicate the existence of static, infinitely-lived SSH keys (e.g., `id_rsa`) across a massive fleet. The target infrastructure is thousands of [OS_DISTRIBUTION] (e.g., Ubuntu or Amazon Linux 2) servers. You must define the precise HashiCorp Vault SSH Secrets Engine (CA type) configuration required to issue highly ephemeral, mathematically signed SSH certificates exclusively for [ACCESS_LEVEL] users (e.g., SREs vs standard developers). Integrate a mandatory [MFA_TYPE] (e.g., YubiKey push) requirement directly into the initial Vault OIDC login phase. Provide the exact client-side bash commands a developer must run to request and utilize a temporary 5-minute signed key, and output the exact, flawless `/etc/ssh/sshd_config` server-side modifications required to force the SSH daemon to trust Vault's CA public key and reject all traditional keys.