I use a Google Titan key for this purpose, have a ssh key password that I can "cache" for the session on my macos key chain, but I have to tap the Titan key for every pull/push