@dlatchx @joel @mischa @graslander on the other hand, rcctl set flags doesn't compose easily as if you want to add a new flag, you have to pass the current list of flags to the command line, so it's not ideal either
maybe this should do the trick
rcctl set sshd flags $(rcctl get sshd flags) -o PasswordAuthentication=no