Different issue. It is definitely best practice to use a long passphrase to protect every secret key, this is off topic. What I meant was, you connect to the S

Different issue. It is definitely best practice to use a long passphrase to protect every secret key, this is off topic. What I meant was, you connect to the SSH server and authenticate cryptographically (use passphrase locally when prompted) - then you also need a logon + password for the SSH server to complete the authentication. This would reject the internet noise banging on the port, but impose a 2 factor test.