Unfortunately as an administrator (outside of a soft policy) there doesn't seem much I can do to ensure that my users have an encrypted ssh private key nor can I control what other machine it's copied to. Which is something that worrying when users add 5 different authorized_keys from this and this account on physical machines and VMs and Android devices.