This objection is weak. Generate a unique key pair on the client. De-authorize it when you're done or just delete it. If your argument is that your client is u

This objection is weak. Generate a unique key pair on the client. De-authorize it when you're done or just delete it. If your argument is that your client is untrusted, then typing in your password is a lot more risky than generating a fresh key pair.