This definitely opens up risks to anyone you pair with. However, the thought is that by restricting access to a specific tmux session and only to those you have explicitly added as "authorized", you can limit those risks by a considerable amount. This works well for us because we only use this for developers on our teams. I would advise not adding anyone's public key to your authorized_keys file that you don't fully trust. Thanks for feedback!