On: How often should I rotate my SSH keys?

[knorker]

Hardware keys. In my opinion it's no longer optional. Nor is it expensive or hard.

E.g. just get a yubikey per employee (or more).

Yes, they can be stolen (put PINs on them), but they can't be copied.

I have just one software key, because i don't have a solution for SSH from my phone with hw key yet.