On top of that, I disable all password logins on every server I run.

If for some reason I must get in and don't have access to my private key, I use a virtual console from my VPS provider to temporarily allow password logins and then immediately disable them when done.

I had a server compromised once because of a default password on the mysql account.