Yeah, I was thinking about that. I intend to give it all its own keys.
Use doas with limited rights so it can diagnose but not do damage without consent. A yubikey is real helpful so it can run commands using a swperate sshkey with more permission, but only if I physical touch the yubikey to approve it.