I agree that neglecting to mention ssh[-agent was a puzzling oversight. I've been using it successfully for ten years now (it has gotten easier since gdm started helping instead of getting in the way), and therefore have a *terrifically* long / high-entropy passphrase on the key, which I type once per login to the box where the private key is stored.
I never reuse my private key across machines, and never allow root login or password-based login over SSH on any host I admin. I like this setup a lot, and can't imagine that anybody thinks password-based schemes are intrinsically "more secure."