These seem to be the current best options, thoughts?
ssh-keygen -t ed25519 -o -a 100 # Higher security
ssh-keygen -t rsa -b 4096 -o -a 100 # Higher compatibility
Current ssh-keygen defaults for t b a: -t rsa -b 3072 -a 100
-o isn’t in the man page, it insures the private-key is using the new OpenSSH format though that’s probably for older versions of ssh-keygen, likewise with -a 100.
-a (better description): The number of KDF (Key Derivation Function) rounds. Higher numbers result in slower passphrase verification, increasing the resistance to brute-force password cracking should the private-key be stolen