You're right, the wording is poor, but the general premise that SSH public/private key auth is a security weakness is valid. Administrators cannot validate tha

You're right, the wording is poor, but the general premise that SSH public/private key auth is a security weakness is valid. Administrators cannot validate that SSH private certs are properly protected with a strong passphrase. Also 2-factor for SSH is rare. With enough employees, chances are high that someone gets lazy and generates a cert without a passphrase.