Yep, there is no point in generating a new key if you can't get the other end to trust it. You could generate a new trusted key every time you log on (and encry

Yep, there is no point in generating a new key if you can't get the other end to trust it. You could generate a new trusted key every time you log on (and encrypt with password), and invalidate the old key, making sure to copy it to your USB. That would roll the keys, and cause you to be locked out with that key if anyone used it. But a bit involved. Single use login codes on paper probably the easiest way around the problem. https://www.digitalocean.com/community/tutorials/install-and-use-otpw https://www.digitalocean.com/community/tutorials/install-and... Also, you can configure the google-authenticator TOTP module to request key and token IIRC. GA also has OTPW backup codes.