I have been managing websites for a while and usually utilize SSH connections to login to, deploy code to, and otherwise remotely access the hosting servers.

I was recently informed that a client I work with considers that a legal risk.

If the SSH connection is set to disallow passwords and only authorize via SSH keys, how big of a risk is this?