It&#x27;s how the SSH protocol itself works. When the client connects to a server, it sends the (remote) username and then a series of public keys. If the server will accept the current public key, it asks the client to authenticate with that key to show that you hold the private key; if it doesn&#x27;t, it says &#x27;try again&#x27;.<p>This means that a malicious client with just the public key can probe to see if a server will accept a given username&#x2F;public key combo. If the server does, it will challenge you to authenticate that you hold the private key (which you&#x27;ll have to fail, since you don&#x27;t have it).