It's even better if you force a hardware two-factor authentication before you grant the ssh cert.