You are focusing on securing the keys on the client side. I would recommend that you take a look on the server side.
On the server, you can limit what they key is allowed to do and what servers it may be used from, by editing the
authorized_keys file for the target account. Here's an example of a key with limits:
from="their.workstation.only.example.com" no-port-forwarding ssh-dss AAA....
You can use IP addresses instead of an FQDN if you like.
In order to prevent the users from tampering with the authorized_keys file, you can move it to a location where they do not have write permission. It will still work as long as they have read permission. This can be done by editing the
sshd_config and changing
%u gets replaced by the username, so when someone connects to ssh with the username
foo, ssh will look for the keyfile in
/usr/local/authorized_keys/foo. As long as
foo has read access to that file, the connection will work.
Edit: Instead of moving the key, you could simply set the file to immutable, like this:
sudo chattr +i /home/user/.ssh/authorized_keys
Once you've set up the source IP limitation, and you've secured the key file against tampering, it won't matter if the private key gets leaked - it still won't be usable from any other system.
There are a lot of other things you can do to limit the users when they connect with keys - see the man page for
sshd. There's also been some questions about this at Serverfault, for example Limited SSH access for log retrieval.