yes, that's exactly what I want :) (and the private key is only living inside 1Password and isn't extractable from there)

Typically you want to generate one key per host. That's why, by default, a new key bears a user@host identifier.

If it gets compromised, you need to revoke this one key only and still maintain access from, presumably, other systems of yours.

https://www.1password.dev/ssh/manage-keys#export-an-ssh-key

You’re mistaken. 1Password syncs keys. Therefore, they’re extractable.