> copy-pasting them to remote machine is more reliable,

This has basically nothing to do with the underlying cryptosystem.

Instead of explicitly configuring RSA keys, SSH could have been setup where you put their SHA256 hash in the authorized key file. (The pubkey itself would sent by the user at auth time and checked against its hash)

That may be true, but just because ed25519 might be better, doesn't mean RSA is a "problem"

In the field of security, much more than in the rest of technology, age is an important factor of being a problem. SHA1 is merely starting to see attacks that can finally be demonstrated rather than theorized, that still take hundreds of CPU-year, 20 years after its inception. But we haven't waited all that time to retire SHA-1, because we know that eventually all schemes fail.

Same holds for RSA.

Are there attacks on RSA with appropriate key sizes? We replaced SHA-1 because the attacks, even if just theoretical, were clearly on the horizon (and we replaced with sha-256 which is basically the same thing with a few tweaks and some parameters increased). RSA certainly has attacks, but they have been compensated with bigger key sizes. Is there any reason to suspect that 4096 bit RSA will be unsafe anytime soon, other than quantum computers?

Disclaimer: Iana cryptographer