passphrase is set/unset locally and not communicated to the server if it is present/used/etc. Could be disabled. along with various other things. HW token wit

passphrase is set/unset locally and not communicated to the server if it is present/used/etc. Could be disabled. along with various other things. HW token with ssh key inside is probably the best. The annoying thing is devices w/o USB. For iOS devices and android devices which support it it's probably better to just use the HW sec features. Something which did bt 4.0le and maybe had a single local LED and button would be better still.