I misunderstood an not set password for a blank password and worried (as a new user) that my asteroid is accessible to anyone who tries to connect on it using password authentication. Then I learned that a not set password has the effect of a disabled password authentication. My suggestion is to add this piece of information.
I ran into this, because I skipped setting a password in the first place and created keys right away. Afterwards becoming (falsely) aware that a login with a blank password is still possible and bustled to disable it.