They are correct. You can't enforce passphrases (at all) on ssh keys, nor can you enforce key rotation unless you have a system that issues both the public and private keys. Even then, the user can simply re-sign the key and remove the passphrase. SSH Keys used correctly can be more secure than 2FA, but I have yet to see anyone actually use them correctly. If you are honest with yourself, you know that most of the folks in your org don't have passphrases on their SSH keys. It is easy enough to test if you have something managing their laptops.