How does jenkins publish over ssh store passphrases?
According to the source code for the Publish Over SSH plugin, the passphrase is encrypted and decrypted using hudson.util.Secret, and the encrypted value is stored in the plugin's XML configuration file.

Supposedly there is ongoing work to switch to using Jenkins' built-in credentials store; however, I don't see any active pull requests for such a change.