I like that with macos, you can create keys with a passphrase, and then that passphrase can be provided by the keychain which is unlocked at login

  ssh-keygen -t ed25519 -b 521 -f .ssh/id_foo_ed25519
  cat id_foo_ed25519.pub | ssh foo tee -a .ssh/authorized_keys   
  ssh-add -K ~/.ssh/id_foo_ed25519

along with:

  Host foo
        HostName foo.bar
        User me
        StrictHostKeyChecking yes
        IdentitiesOnly yes
        IdentityFile ~/.ssh/id_foo_ed25519