Not all credentials are name+password (in fact, using password over SSH is the least secure option available): user authenticates using their name+ssh key. Noth

Not all credentials are name+password (in fact, using password over SSH is the least secure option available): user authenticates using their name+ssh key. Nothing too useful can be captured from that set of credentials, except to confirm their identity. If they also use an U2F, there's no way to capture that: "I am user Piskvorrr...but have no way to prove it." OTOH, this method captures their session, in other words, "I am user Piskvorrr and I have already proven it by successfully authenticating".