Well done! As for PKI authentication the most commonly used method is RSA. Not sure if RSA is supported in Trezor at current. Also having key specific to user and host is probably secure, but according to my experience enterprise servers work on one/few keys per user basis. The reason is public keys life cycle cost.

It is certainly possible to code Windows tray application which would emulate Pageant (enables Putty and WinSCP) and use key from Trezor. I’ve done it for smartcards (PKCS11) already.