For SSH, you can use cheaper FIDO2 hardware to split your key between a computer and say a Google USB titan key or similar.
For Windows, you need to compile (cf https://gist.github.com/martelletto/6a7cf806c6433ac9ce71d66a... ) then ssh-keygen -t ecdsa-sk
For Linux, if you need to recompile: https://cloud.google.com/compute/docs/tutorials/ssh-with-sk
On modern Macs, you can also use the Secure Enclave for SSH private keys: