We keep all this stuff behind WireGuard, which is what I would recommend everybody do.
But Tailscale ssh has the identity stuff built in too.