[computerfriend]

The enlightenment has happened in the other comments, but the summary is:

* this enforces high entropy,

* the password is transmitted to the server, the private key is not.