When generating new authentication keys with SSH for a user, where should the private key be kept?

The private key is required on the client machine to authenticate the user to the remote server; it must be kept secure but accessible by the user on any trusted system they use to log in via SSH. A common practice is to protect it with a strong passphrase and ensure file permissions are restrictive.

While a CD-ROM or USB stick can be secure, it makes the key inconvenient for regular use and is typically not the primary location for an actively used SSH private key.

Printing a private key introduces security risks like physical theft and makes it unusable for digital authentication without re-typing.

Restricting the private key to only the creation machine limits its utility, as users often need to SSH from multiple trusted devices.

SSH absolutely uses private and public keys for authentication; public key cryptography is a cornerstone of SSH security.