I always generated new keys on new devices. I never moved a private key off the device where it was generated. It just felt like doing so creates all sorts of o

I always generated new keys on new devices. I never moved a private key off the device where it was generated. It just felt like doing so creates all sorts of opportunities for mistakes and loss. While it's more work to add or rotate public keys than it is to move private keys, IMO it's also safer. When I had to manage keys for a bunch of servers and services, at first I segmented them by scope of potential compromise. For example, I had one key pair for my hosting environment, and a separate one for Github, since I had access to more repos than just the apps I was hosting. But eventually I stopped doing that because the weak point was the device; if my device was stolen, so were all the private keys, no matter how many there were. So, might as well just have one key per device. I always set passwords on my private keys, and stored the password in an encrypted file: either KeePass, or Keychain on my Mac. I managed all my SSH hosts a .ssh/config file, so I could connect on the command line with just a nickname. Edit: this was all to manage an infrastructure for developing and hosting a few dozen websites.