I’m curious why people say not to have ssh exposed if you only have key auth enabled. It seems to me that every single other password + some other number of protections is inherently weaker than simple old public key auth.