IMHO sshd should, by default, disable root login and only allow user login with keys (i.e. disable password authentication). That's how I configured mine anyway.
My idea with changing password was to give user opportunity to login without it and then configure system as she wants.