>keeping their ssh and pgp keys somewhere else than a local machine

This is Google. Who is using ssh keys for anything?