[ds9]

Different issue. It is definitely best practice to use a long passphrase to protect every secret key, this is off topic.

What I meant was, you connect to the SSH server and authenticate cryptographically (use passphrase locally when prompted) - then you also need a logon + password for the SSH server to complete the authentication. This would reject the internet noise banging on the port, but impose a 2 factor test.

[tptacek]

If you want two factors for SSH authentication, you can and should set up a two-factor auth system, like Duo.