I should have been more explicit, you're right it's not necessary for SSH with keys.

I was thinking more about preventing spam on web servers.

This is why we enable port knocking (SPA) on all of our Internet-facing systems: it protects against zero-days and keeps the logs pristine. As a matter fact, any failed login of any kind creates a security alert.

I use it for ssh, ftp, and dovecot. Even with ssh passwords disabled, fail2ban reduces traffic a lot on some servers (since culprits get null-routed) which is always good.

I like to use it just to make logs more readable.