How does your team handle shared SSH access without it turning into a mess?

Curious how other teams here deal with this. Every setup I've seen falls into roughly the same three patterns:

1. A shared key or password everyone copies locally, and nobody remembers to rotate it when someone leaves

2. Credentials scattered across Slack DMs, a password manager not built for SSH, or a spreadsheet someone maintains "temporarily"

3. A proper PAM/bastion setup, which works but is a lot of infra to stand up for a 5-10 person team

I've been deep in this problem building a team SSH client (SecurSSH, still early), and the offboarding case is what keeps coming up in conversations: how fast can you actually cut access when someone leaves, and does anyone actually check?

What's your current setup? And has it ever bitten you?