Why not let the administrator decide?

Why not let the administrator decide?

Even a strong password that's stored in ~/passwords.txt on my local disk is a significant security upgrade on a weak password on a networked system. Attacking a system that deliberately lets you log in over the network is significantly simpler than getting a copy of a file on my local disk.

And the admin can't guarantee that I'm not doing something stupid - I did point out that you can have the keys stored in a key manager that requires a hardware token to unlock (modern password managers can act as SSH agents, for example, requiring a hardware token to unlock the password manager). But making the attacker attack my system to get my account, rather than opening up attacks like "crack the password someone uses on MySpace, transform it and use it to log into your system" is a worthwhile endeavour.