Thorn's uncle is totally right
and yeah, it's never enough...sometime s when i make recommendations to my customers, they are just smiling at me and say that i'm mad and totaly "uberparanoid"...but i've seen their networks falling down in cause of not following my recommendations...however
yes pki is a nice toy to play with...smartcards, tokens...all those little nice gimmicks..
PS: you got a ssh client for your ipaq wich supports aes256