Now that's an idea worth investigating.
As @caf shows, a RSA private key has a lot of internal structure, which is easily recognized. It would be very difficult to design a password-based encryption scheme such that the decryption of an encrypted RSA key with the wrong password still yields something which looks like a valid RSA private key.
However, this is relatively easy to do with DSA keys (and also with the elliptic-curve variant ECDSA). A DSA private key uses key parameters (called p, q and g) which are not required to be secret (they are also present in the corresponding public key); the only really private part in the key is x, an integer modulo q. Any integer modulo q is a valid DSA private key. So you can make a password-based encryption of x that way:
- Choose q to be a 256-bit number (i.e. 2255 < q < 2256).
- Use a block cipher with 256-bit blocks (e.g. Rijndael -- the AES is Rijndael with 128-bit blocks and 128-bit, 192-bit or 256-bit keys, but the original Rijndael also has a mode with 256-bit blocks).
- To encrypt x with a password, first derive a key from the password (use bcrypt !) and then encrypt x (as a 256-bit string) with Rijndael. If the resulting string is not (when interpreted as a number) in the [0..q-1] range, then encrypt it again, and again, until you get back to the expected range. On average, you'll need to call Rijndael less than twice, so this is not computationally hard.
- To decrypt x, just derive a key from the typed password, and apply Rijndael decryption. There again, do it recursively until you get back to the [0..q-1] range.
So this is doable. Is it a good idea ? The advantage of such encryption is that the password can no longer be brute-forced by an attacker who got a copy of the encrypted private key. On the other hand, if the attacker also has a copy of the public key, then he can easily verify that he decrypted with the right password. The public key being, well, meant to be public, it is not necessarily kept as confidential as the private key. The target server has it. Actually, all servers for which the private key is used to login have a copy of the public key. So the public key is only moderately confidential, at best. Therefore, the advantage provided by "unverifiable password encryption" as described above, seems tenuous. On the other hand, it has the following drawback: if the user mistypes his password, the server is still interrogated, and SSH can no longer make the distinction between "user fumbled with his keyboard" and "there's something wrong on the server".
So while what you ask for is feasible for at least some key types, it is understandable that it has not been implemented (yet). It is not an uncontested win; it is a trade-off between usability and security (you would loose a bit of usability to gain a bit of security).