With SSH you can stick a certificate on the target machine (once) and then log in without a password. Some SSH clients require a local password to open the local certificate, but it would not be in memory on the client longer than to open the cert. It may even be possible to authenticate to another program (e.g. with PuTTY/Pagent on Win32).