I'm not ignoring password problems I didn't make any mention of passwords one way or the other. You seem to be ascribing views to me that I just didn't state, I

I'm not ignoring password problems I didn't make any mention of passwords one way or the other. You seem to be ascribing views to me that I just didn't state, I'm guessing this is you assuming my world view, a common issue with Internet discussions. I didn't say passwords were good, I said that people often overlook the weaknesses of managing SSH key based deployments. key proliferation is a real issue and as passphrases on SSH keys are susceptible to offline attack, without very strong passphrases they can present a risk. Also in my experience centrally managed key rotation and expiry is rarely included, thus the risk that if a key is compromised, detection/revokation/re-issuance are hard. To provide some background I've been an IT security professional for 15 years, I know the ups and downs of various authentication mechanisms, I was just pointing out a rarely noted downside of SSH key based auth. given you seemed from your comments to view it as an unalloyed good.