That's correct-- secure password encrypts the ssh keys. Those keys then access the server, which has my pass vault, gpg keys, two factor recovery codes, etc.