Is SSH key based authentication something that happens to replace password authentication or does it supplement password authentication?
Several authentication methods can be allowed, but only one is usually1 used – for example, if the server offers
gssapi-with-mic, publickey, password and client chooses
publickey, then only the key will be used for authentication and all other methods will be skipped.
1 In some very rare situations, two auth methods will be used for the same connection – for example, when the first connection to Bitvise WinSSHd uses publickey it will additionally ask for the password – but this is an exception to the rule.