An increased use of SSH keys for credential guessing is also found in our SSH honeypot: https://pmcao.github.io/caudit/

Heh - people are harvesting compromised secret keys then? Because "guessing" secret keys shouldn't be viable?

An increased use of SSH keys is also found in our SSH honeypot: https://pmcao.github.io/caudit/ ~ plugging our paper.

SSH brute-force attacks still pose a significant risk. See our related paper on SSH auditing driven by attacker's attempts here https://pmcao.github.io/caudit/