If the users users ssh keys, then the leading ! in /etc/shadow doesn't actually lock them out from remote access. It only blocks password access. A fully locked out user has both the leading ! and an invalid login shell, or just a commented out password entry.
1ly4me
Yes, /etc/passwd file gives you access right for every user unless the users are allowed through SSH authorization.
farzanj
Even SSH relies on /etc/passwd and /etc/shadow mechanism except in case of ssh public/private key certificates in which case, it would bypass passwords completely. But in this case there would be ~/.ssh/authorized_keys file with public part of certificates.