I make my sshd only listen on the Tailscale IP. Then I don’t even bother setting up SSH keys. I use password authentication, except on mobile where my password is too difficult to type with an onscreen keyboard.