While making the port number based on a TOTP token is clearly just for fun, it's not unusual to not entirely trust public key authentication. This is an additi

While making the port number based on a TOTP token is clearly just for fun, it's not unusual to not entirely trust public key authentication. This is an additional security step. Once public key authentication is allowed, the mechanism is only as secure as the private key. There is no way to require a password on private keys, and in any event it could be captured with a keylogger. The concern is not the cryptographic strength of the key, it's end-user security. While randomizing the port is not security, no one would say 2FA is not required because we can trust RSA.