but they require chmod 400 and they're ideally in on an encrypted disk

So the desk drawer is locked and the codes are Luks encrypted.

And for critical stuff, you should also have a password on the key.

If your ssh keys are like a passwords on paper in a drawer, you're doing it wrong.