Additionally, you can have substitutions in there: Host * IdentityFile ~/.ssh/%r@%h This is indeed better, as a compromise means only the private keys o

Additionally, you can have substitutions in there: Host * IdentityFile ~/.ssh/%r@%h This is indeed better, as a compromise means only the private keys on the affected host are affected. That of course works better with a keypair per source/destination combination. Note that this _does_ cause issues sometimes, as it means your ssh-agent (you _are_ using one of those, right?) will have more keys than a typical auth attempt limit, and software that assumes trying all your keys before prompting for input is a sane thing to do will fail.