IMHO sshd should, by default, disable root login and only allow user login with keys (i.e. disable password authentication). That's how I configured mine anyway.