Is password + second factor more secure than public key auth now? (SSH)

I ask this question because, I think, we now can reasonably assume the following:

1. NSA can break VPN and SSH: This is stated many times in the unclassified slides. Also, GCHQ has demonstrated (and boasted) about this capability in the wild.


2. NSA has a database of stolen keys: They can somehow get SSH keys. The slides imply they have a database of stolen keys (I think it says something like, 'check to see if key in DB').


3. It is easier to steal the private/public keys than it is to steal the TOTP from my air-gap'd phone/ipod touch.

If it is true that agencies can easily acquire keys, then would it not make more sense to use password + google TOTP second factor authentication for each SSH login?

It seems google's TOTP second factor authentication does not work out-of-the-box if publickeyauth is used. So, there is a temptation to disable public keys and use only password + second factor.

Taking the latest leaks into account, if I have to choose between public key auth and password + TOTP second auth, which is better in terms of security? (I explicitly cannot use both).

(I don't care about convenience, they are both the same for me).

Thank you.