I would add, it is time to use properly managed keys. i.e. ssh keys with passwords and IP restrictions. Even better, a centralized CA and expiration of keys.

I would add, it is time to use properly managed keys. i.e. ssh keys with passwords and IP restrictions. Even better, a centralized CA and expiration of keys. Keys can be equally as dangerous as passwords if not managed correctly. Public keys, even more so. What systems and accounts trust my public key? Who knows? What is managing and mapping that? Did I have sudo for a while and shove my public key into your authorized_keys file? Are your ssh instances using the default location for authorized_keys that users can write to? Is this appropriate in your use case? Certainly not for production machines, right? Do you rotate your ssh keys that are used in automation? Are your keys limited to specific CIDR blocks? etc... things to consider.