Out of curiosity, and also to check whether this is doable at all:
Is there any way using standard tools to assign an expiry date [only] to the passphrase of an ssh private key, or to enforce the expiry and change of the passphrase without changing the private key itself? (I'm not talking about scripts that check [a,c,m]time of the keypair or something like that ...)
Or is there any standard solution that achieves a similar result, that is enforcing/ensuring regular change of the passphrase for keybased authentication?
Please don't ask WHY I want to do that, but feel free to comment on the added security/inconvenience/insecurity this might provide.
The only thing loosely related seems to be the validity interval that can be specified when creating the keypair via ssh-keygen. Although if I've understood this correctly that would expire the signing certificate which was used to sign the keypair, hence effectively expiring the key itself.