I'm surprised to see ssh-keygen being called more often than ps. Perhaps this is skewed by history files being sourced from development boxes?