Fedora intrusion update

Unlike poor quality passwords there's no way to test for it on the server, the SSH client, understandably, doesn't advertise how well protected your keys are, so the server has to assume you're protecting them adequately.

While password discovery would be a big threat for an organised attack, since passwords are notoriously poorly protected by users, an unprotected SSH key is a lot more plausible as an attack of opportunity - a bad guy finds a SSH account somewhere, it has an unprotected key, and he uses the known hosts lists* to break into all the machines where it is valid. He's looking through the list for anything interesting and sees - aha- a Red Hat development machine.

* Well known vulnerability: SSH clients store the list of hosts they've previously connected to in plaintext, in order to facilitate fast confirmation of previously seen host keys. This list is stored with similar privileges (and often adjacent) to the private key material. So someone who can steal the key can nearly always also steal a list of hosts where it is most likely to be valid. The best available threat reduction is a hashing phase, which stores only a hash of the destination hosts, increasing the work needed for an attacker to identify the hosts. But this reduction is far from completely effective and is not widely enabled anyway, particularly by the sort of person who doesn't bother to have a good passphrase for their key.