I use public/private with the private key handled by Yubikey PIV functionality.