* Use a non-standard ssh port

If someone has your private ssh key, then they presumably have access to your client-side ssh configuration. This might prevent random Internet attacks, but this doesn't do much against a targeted attack (which is what someone will do once they jack your private key).

  * Disable root ssh login

If your private key isn't authorized for root anyways, this doesn't really matter. This is just a point of general ssh security, not a protection against stolen private keys.

  * Configure 'Single Packet Authorization and Port Knocking' --
    http://www.cipherdyne.org/fwknop/

As with point 1, if someone is able to jack your private ssh key, they probably have enough access to view your ssh config.

  * Have decent iptables rules. Use either fail2ban or denyhosts
    with stringent rules, if you must, that ban on 3+ failed
    logins.

If someone steals your private key, then they won't have any failed login attempts. I'm unsure how you feel this makes using a password-less private key anymore secure.

  * Have a whitelist of acceptable IP's for ssh access

This presumably defeats the purpose of ssh mobility.

  * Use any system of 2-factor authentication. I'm partial to
    Google's Authenticator. Here're some directions to get that
    set up, if anyone is interested:   

Using a password (something you know) + private key (something you have) already is two-factor authentication.