So for these users, should we still regularly check to see if an authorized_keys file is created for them maliciously? If we don't, it would be a good way for someone to put in an undetected backdoor into a system they have access to.