Privilege Separation Design Question

[Hans Harder]

And if you don't use passwords at all..... ?
for instance disabled the keyboard interactive login method....

We only use sshkeys and sshcertificates, so there is no need for
having a password.enabled account
That reduces a lot off password administration

Also if you do that in the middle of automatic script activity, I have
no idea what will go wrong