I've not seen any rationale why sites haven't done something sensible. Sensible, like allowing automation without storing your password to use sshpass, for ins

I've not seen any rationale why sites haven't done something sensible. Sensible, like allowing automation without storing your password to use sshpass, for instance; then if you insist on MFA, that can be done when issuing an ephemeral certificate. "Certificate" might bring back bad memories of Globus et al, but that was different, and I haven't seen it articulated. The general response to those compromises has been a disaster area. Especially as (in the absence of any post mortem, as far as I know) the attack presumably involved the general password-spraying that was happening around then. Users were made to look responsible and suffer because systems had local privilege escalations due to poor management -- which, to be fair, might be due to relying on cluster vendors who "take security very seriously", as they say. That has been around the top of the threat list for decades too, it's just that it's now much larger scale. Then you got private keys purged that might be used to access systems on other sites with less risk than typing passwords on insecure systems -- arbitrarily deleting users' data.