I normally just skip keygen

it's such a hassle

besides, it means I can connect from anywhere

no one checks the ssh port on prod anyway