If you use the u2f support in openSSH the risk of credentials being stolen without you knowing basically goes down to zero (as in, if you have the physical key

If you use the u2f support in openSSH the risk of credentials being stolen without you knowing basically goes down to zero (as in, if you have the physical key the credential isn't stolen).