Whoops, commented in the wrong SSH config file.

That being said, we could still make sure that as part of bootstrapping we're initializing certain users and disallowing SSH by root.