Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.
Use the policy below to verify
SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');