To manage it, probably that or IP restrictions. I assume team dang has IP/CIDR restrictions set on their authorized_keys in sshd. For the rest of us, probably

To manage it, probably that or IP restrictions. I assume team dang has IP/CIDR restrictions set on their authorized_keys in sshd. For the rest of us, probably just simple / basic password complexity and some attempt at detecting brute force if that is not already a thing. My personal preference for any site would be to also have an option for cidr/IP approve-list.