Sure thing. I really meant that my Oracle Cloud account is protected by my YubiKey, and when I provision an instance I set a strong, pre-hashed password for the

Sure thing. I really meant that my Oracle Cloud account is protected by my YubiKey, and when I provision an instance I set a strong, pre-hashed password for the local account in the CloudInit configuration. If I ever need emergency maintenance access, I can use the OCI instance console from the dashboard rather than SSH. SSH itself is configured to accept publickey authentication only, disallow root login, and only listen on the Tailnet IP range. So the password isn’t part of the normal SSH access path.