Use a key for one task
Separate keys make it possible to revoke temporary access without disturbing a permanent administrator. Give each key an identifiable comment and use an expiration restriction when supported by the server. Keep private key material on the client and out of reports. A public key may be shared for installation; its matching private key should not be copied into the server's authorization file.
Confirm the server too
Client authentication is only half the connection. Check the server's host key against a trusted record. A host-key mismatch deserves investigation; accepting a replacement automatically removes the protection against connecting to the wrong machine. Automation should fail clearly instead of silently changing trust.
Revoke exactly what you added
Record the added public-key blob before starting. At cleanup, remove that exact authorization rather than replacing the entire authorized_keys file. Preserve other administrators' lines and the file's restrictive ownership. Before firewall or SSH configuration changes, retain a working session and know which out-of-band console is available. A recovery plan is more valuable before the risky edit than after it.
At the terminal
ssh-keygen -t ed25519 -f task_key -C temporary-maintenance
ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -i task_key user@example.com
# Validate server syntax before any planned SSH reload.
sudo sshd -t