I believe this article is a bit out of context, yes? In an ordinary environment (at home, at big corp.) you treat your keys as highly personal valuables and wo

I believe this article is a bit out of context, yes? In an ordinary environment (at home, at big corp.) you treat your keys as highly personal valuables and would not store keys at shared storage (unless special circumstances, due to air gaps or because shared non personal jobs need to run with a key - and then by a separately generated key). If I'm at that point that I would have to rotate my private SSH key, then game is lost anyway. If the storage at your personal device cannot be encrypted, might it be a solution to pass along something like ssh-add - <<< "$(pass show ssh/env1-key1)", and have that gpg-key on a yubikey for instance. In my (perhaps too small) view, this issue is not the issue, and the issue should instead be tackled. For instance, not by letting SSH be publicly accessible as the first thing and educate staff on locking their personal workstations. With the correct mindset other things should be of focus in the area of security.