Other points are fine, but why do you say a 20-character random password isn’t comparable in brute force complexity to an SSH key?