Logically you're going to need some kind of digital key, and logically keys can get stolen. So the problem is detecting theft. Rotating keys is not detecting th

Logically you're going to need some kind of digital key, and logically keys can get stolen. So the problem is detecting theft. Rotating keys is not detecting theft, YubiKey is not detecting theft. Could some kind of jump server where all your ssh connections for your company's servers have to originate from do the trick of logging, reporting and restricting usage to detect theft? You log in with key1 to an unprivileged account on the jump server, and it decides if you look genuine (based on ip/ time of day/ time since last usage/ whatever) and then alerts an admin if a trigger is ticked. Then if you get access, you as a user are given logs to help you detect theft. Then if all is well you SSH to your actual destination, perhaps through port forwarding using key2 stored on your local machine, or perhaps from the jump server with key2 stored there.