Federated CAs vs Reverse Proxy?

[hardillb]

I'm trying to work out the best way to make the following work

• I want a CA that issues certificates via ACME for internal web applications
• Also issues SSH user Certificates for access to machines
• I want to make the SSH accessible machines accessible from the internet
• I don't want to expose the ACME endpoint to the internet (also would rather not use EAB to force authentication for ACME)

(To be clear, there will also be a paired Keycloak SSO provider for authenticating when issuing certificates)

Is using 2 federated SmallStep CA a valid solution? One CA would be exposed internally and configured with ACME provider, the second would be exposed to the internet but not have a ACME provider?

Or is the simpler option to just use a reverse proxy (to expose to the internet) with a single CA and blocking access to the ACME routes?