I quite like Tailscale SSH for this, but I don't have as many machines, so not sure how it will scale. You can definitely assign roles here to allow/deny SSH between hosts in your fleet though.

I keep hearing this about Arch: could you educate a noob on what kinds of things I'd be dealing with? I'm comfortable with Linux in general but somewhat apprehensive with what I hear about Arch

That was it, thank you!

I have a few of these but I forget where they came from, curious if anyone here knows

Ivory for Mastodon also has it, and I'm assuming it came from their Twitter client (never used it myself though)

I mean, this is Google we're talking about...