They are correct.  You can&#x27;t enforce passphrases (at all) on ssh keys, nor can you enforce key rotation unless you have a system that issues both the public and private keys.  Even then, the user can simply re-sign the key and remove the passphrase.   SSH Keys used correctly can be more secure than 2FA, but I have yet to see anyone actually use them correctly.  If you are honest with yourself, you know that most of the folks in your org don&#x27;t have passphrases on their SSH keys.  It is easy enough to test if you have something managing their laptops.