Yes, it is indeed correct that if somebody grabs the ssh command with the key while you are debugging, it is accessible. It's something that we want to address in a better way, but other priorities are present right now (build image updates, performance improvements, some new features that we haven't announced yet.) Still, the feedback is appreciated!