I'd add to this list that in 2023 you should be securely storing your key in a HSM.
On Mac, that's easy to do via the Secure Enclave: https://github.com/maxgoedjen/secretive
On Mac, that's easy to do via the Secure Enclave: https://github.com/maxgoedjen/secretive
https://github.com/Foxboron/ssh-tpm-agent
Currently hacking up better support for `HostKeyAgent` and `HostKey` for `sshd`.
I used to use an easily memorizable password, but you said that was wrong, and set me straight. Now my password is so complex, I have to rely upon a 3rd party service, that keeps getting hacked.
Then you insisted I use keys. After, you became irate if I left the keys on my work dir.
Now you want me to lug around a 2U HSM appliance?!
For shame!
And there's a big dog chained to the desk beside it. Biometric security, you see: if you don't smell right to Brutus, you don't get to log on.
Look at our security rituals from an outside view: we sure do seem to spend a lot of time propitiating our idols of one kind or another.
If you don't need a certified HSM that generates keys on device (and you don't, right? You can generate keys on a ramdisk from live media with no persistence and no/encrypted swap), you can use basically any PGP smartcard, including nice little USB ones like Yubikey and NitroKey. And even if you do you can get a little USB HSM.