I will stick with ssh keys, except that I:

- Put the public authorized keys in /etc/ssh/keys/%u immutable, monitored for checksum changes.

- Have CIDR restrictions in said public keys.

    from="x.x.x.x/n,x.x.x.x/n" ssh-ed25519 AAAA[snip] Text-Identifier

- Have NFTables checks for MSS, TCP SYN TTL, Window sizes, CIDR blocks permitted on the public ssh instances (throw away nodes) and behind a VPN on more important roles. If I have a need to keep netfilter disabled then I put sshd behind L4 haproxy with ACL's.