

Broadly speaking, the private keys can be protected.
For ssh, ssh-agent can retain the viable form for convenience while leaving the ssh key passphrase encrypted on disk. Beyond that your entire filesystem should be further encrypted for further offline protection.
Passkeys as used in webauthn are generally very specifically protected in accordance with the browser restrictions. For example, secured in a tpm protected storage, and authenticated by pin or biometric.





Getting a dns name is straightforward enough, and let’s encrypt to get a tla cert…
But for purely internal services that you didn’t otherwise want to publish extremely, the complexity goes way up (either maintain a bunch of domain names externally to renew certificates and use a private DNS to point them to the real place locally, or make your own CA and make all the client devices enroll it. Of course I’m less concerned about passkeys internally.