Change (or add) the passphrase on an SSH private key — by Mike Mazur on Server Fault
ssh-keygen -p changes the passphrase on an existing key without generating a new one, so servers that already trust the key keep working. Use -f to choose a key file other than the default.