When generating new authentication keys with SSH for a user, where should the private key be kept?

The private key is a secret credential used by the client machine to prove its identity to an SSH server. Therefore, it must reside on the trusted system(s) from which the user intends to log in, typically in the `~/.ssh/` directory, and protected with strong permissions and often a passphrase.

While a CD-ROM or USB stick can be used for secure storage, the private key needs to be accessible on the client system for SSH to function, making this an impractical primary location for regular use.

Printing a private key introduces a physical security risk and makes it unusable for automated SSH authentication.

Limiting the private key to only the creation machine restricts the user's ability to log in from other trusted clients, which is a common use case for SSH keys.

SSH (Secure Shell) heavily relies on asymmetric cryptography, which uses a pair of keys: a public key (placed on the server) and a private key (kept by the user).