Create or edit a configuration profile with the following information:

Create or edit the following script and configure it to run when the check fails:

SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');

if find /Users -type f -path "*/.ssh/id_*" ! -name "*.pub" 2>/dev/null | while read -r f; do grep -q "ENCRYPTED" "$f" || { echo "$f" && break; }; done | grep -q .; then echo 0; else echo 1; fi