SSH&#x27;s new AuthenticationMethods directive is extremely useful for pairing SSH keys with a password and&#x2F;or 2FA. You should absolutely use keys everywhere, and encourage your users to encrypt their keys, but enforcing a password as well ensures that logins are &quot;something you have&quot; (the SSH key) and &quot;something you know&quot; (the password) as a sort of 2FA.<p>As a cherry on top you can put the password in LDAP or RADIUS server and hook up traditional 2FA (Google Auth, Yubikey, Email, SMS) for that legendary 3FA (ah... &quot;something (else) you have&quot;). Sounds hokey, but defense is best in depth.