Another way is to use a hardware key for your ssh keys. I use a yubikey for ssh and for encrypting my passwords (via passage). Of course they could still steal

Another way is to use a hardware key for your ssh keys. I use a yubikey for ssh and for encrypting my passwords (via passage). Of course they could still steal my session tokens or try to backdoor my browser to catch my passwords when I enter them, but its a higher bar to clear.