> Ship them off to where? A system that also can be accessed with your ssh key? If the ssh key you lost has access to all the critical infrastructure, then, ce

> Ship them off to where? A system that also can be accessed with your ssh key? If the ssh key you lost has access to all the critical infrastructure, then, certainly you have a problem. The solution is to not give away write-access keys to your entire system. > If either is true, they now have access to everything not protected by 2FA that uses an email address they now control. The initial question was not whether losing a key would cause a breach, but whether a detection mechanism is reliable. > Or you know, you could also just rotate your ssh keys in addition to everything else. The question is how does it help? If you can't detect a breach, it will live for as long as your key rotation policy, if not longer. If you can detect and mitigate a breach, it will be closed quickly regardless of your rotation policy.