SSH and GPG each ask for passphrases during key generation. GPG also (at least from my experience) displays warnings if one is not provided and asks for confirmation that no security is indeed desirable.
Thus, it would seem, it is important to provide such passphrases.
However, assuming full disk encryption, I can't really get why?
My (likely flawed) thinking is as follows. These are threats to private keys:
- Device theft; but if someone steals a device that is powered off then FDE already protects me from this (at least until the thief is determined enough to apply rubberhose decryption on me);
- Momentary physical access; but in this case I'm hosed either way;
- My PC is compromised, someone managed to install malware on my device; but in this case, again, I'm hosed either way because I have a keylogger installed that steals my passphrase. And that's even if the attacker wasn't able to root my PC!
Thus, the only scenario I can think of when the passphrase can be any good is theft of a powered on device; then indeed the passphrase might save me; but I find such a scenario not very likely. On the other hand, having to reenter the passphrase each time I make a git commit or send e-mail is annoying.
What are the uses of passphrases protecting SSH / GPG private keys I'm not aware of?