&gt; Exposing shared public keys creates an information leak; it allows attackers to probe for valid and usable username&#x2F;key combinations on your servers (and thereby discover valid usernames).<p>How? That&#x27;s now how public key auth works...<p>&gt; Not sharing public keys between different services and contexts (eg not using your Github keys for anything else) mitigates this risk significantly.<p>This is true for other reasons, and you can automate it with some shell scripts.