When a keypair is created for a normal user, there is an option to symmetrically encrypt the private key with 3DES. I usually believe this to be a good idea, then even if the key is stolen, it will be useless to the attacker.
I've noticed that on each machine (Ubuntu-based, at least) that is running sshd, the private key file that is generated when the sshd server software is installed /etc/ssh/ssh_host_rsa_key is not encrypted with 3DES. Is it possible to force sshd to use an encrypted key, without encrypting the whole disk?
I think of it as similar to the way Apache-over-ssl uses keys. If it's encrypted, every time apache is run, the password must be entered to decrypt the private key. Does sshd have a similar capability?