PermitRootLogin no
Nobody should use the server as root, and therefore nobody should be able to login a root via ssh. Just > to make sure you have an user with sudo created on the machine.

… a usual mistake, since ssh with rsa key to user + sudo is not safer than directly ssh as root with rsa key.
sudo is its own can of worms…