Use one key pair per device. If you lose the device, remove the associated public key from the server's authorized keys.

Using a password on they key isn't a bad idea either.