It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creati

It means a lot because I have to physically touch the device every single time I ssh. I can even do agent fowarding taboos and know an attacker can't go creating new connections on that agent without a physical action from me each and every time. Compare this to how ssh keys are normally used. You use it once, type in a keyloggable passphrase, and the key is unpacked plaintext into system memory for, in most cases, the rest of the time the system is booted. You could invalidate the passphrase after every connection but this puts an unreasonable amount of work on the developer. Simply tapping once for each connection and having no way for an attacker to avoid that is a great middle ground, imo. Particularly for high level production keys.