[bulibuta]

Scary stuff.

Please use passwords for your keys and allow key access only to a small set of known IP addresses.

Also do share other security techniques you're using besides the ones above.

[danielpal]

Passwords are useful, but impossible to enforce. If anyone decides not to use the passwords for their key you are in the same spot. You need better tools, something you can enforce server side. We use two-factor: (note that I founded Authy) http://blog.authy.com/two-factor-ssh-in-thirty-seconds