For extra :lock:, we should have an optional module that: - copies public key(s) onto Pi - disables password auth in ssh config - restarts sshd