Exactly. This is the #1 problem I have with the implementation: I want to set up public-key authentication as the only option on openssh ("Remote Login").
You create and run one fixup script as root to modify /etc/ssh/sshd_config. That is root writable and not protected by SIP. It is a tiny hassle, but really no big deal. The fixup script can handle any of these cases, assuming they are in config files that are writable.
