Someone might post his/her config file on the Internet with a password included. We might not want to encourage this as standard practice. Perhaps we can provide an alternative mechanism.
Use https://asyncssh.readthedocs.io/en/latest/api.html#asyncssh.SSHClient.password_auth_requested to get password interactively during startup or read from some other file like .secrets or from keyring.