Not their passwords, tho. I am not trying to be difficult here, just trying to understand the reasoning behind leaving the passwords stored in plain text.
If you used ‘platform specific’ built-in secrets sync you’d be done... but then how would you justify charging for the built in sync? So I see your conundrum.
If someone can read the files in .ssh, chances are they can also add an alias to the ssh command that steals your passphrase. As for the "stolen laptop" scenario, whole disk encryption is preferable.