I'm curious about a setup that involves downloading sensitive information from an SFTP server over the internet. The current approach is for the clients to connect to the SFTP server with a private key.
The vendor (who hosts the SFTP server) is now suggesting to switch to a model where the clients receive public keys to connect to their accounts.
Is there any downside in flipping around the authentication from previously private keys to a public key model?
My understanding is that in both scenarios the client is not proving his identity but in the private key solution at least the private key can be protected with a password to add an extra layer of security.