I prefer minimising the amount of work required to replace compromised keys. e.g.: I have a private SSH key on my work-supplied computer which I consider to be

I prefer minimising the amount of work required to replace compromised keys. e.g.: I have a private SSH key on my work-supplied computer which I consider to be "compromised" for private purposes, but it's perfectly usable for work inside that company. Use IdentityFile to specify which key to use with which remote host and you're golden. edit: I also have that private SSH key on my personal computers so I can use SSH when working from home. Then when I stop working with that company I can simply remove that key, rather than generating a new SSH key and redistributing public keys to hosts that I use regularly. edit edit: Using IdentityFile also helps automate the process of redistributing keys when you decide to generate a new one.