iirc the double config file nonsense is another genius move brought to you by debian maintainers.

it seriously bothered me that an update automatically re-enabled password authentication. i ended up switching to a different OS.