It is said in ssh man:
-i identity_file Selects a file from which the identity (private key) for public key authentication is read. The default is ~/.ssh/identity for protocol version 1, and ~/.ssh/id_dsa, ~/.ssh/id_ecdsa, ~/.ssh/id_ed25519 and ~/.ssh/id_rsa for protocol version 2. Identity files may also be specified on a per-host basis in the con‐ figuration file. It is possible to have multiple -i options (and multiple identities specified in configura‐ tion files). If no certificates have been explicitly specified by the CertificateFile directive, ssh will also try to load certificate information from the filename obtained by appending -cert.pub to identity file‐ names.
It states, that identity file is a PRIVATE key.
But doesn't it violates security principle, that private key should be kept in secret?
If ssh transmits the key over network, it can be compromised.
I would expect, that target machine keep private key, and check incoming user's public key.
What is wrong in my understanding?
If ssh is sending private key over network, then what is advantage of it over just using password?