Comment by procaryote

There are lots of ways to secure your private keys though, including passphrases, having a ssh agent that requires interaction to use a key, having them on hardware security keys etc.

Having osc52 paste default off seems very reasonable