As several documents mention, it should be possible to authenticate on a switch via radius with a public key.
For example http://freeradius.1045715.n5.nabble.com/SSH-to-Cisco-Devices-td5714654.html
I tried several ways, for example
aaa group server radius RadiusServer
server-private <IP> auth-port 1812 acct-port 1813 key 7 <KE>
aaa authentication attempts login 2
aaa authentication login default group RadiusServerlocal
aaa authorization exec default group RadiusServer if-authenticated
But the switch always displays the password prompt and I always got the message
Info: [eap] No EAP-Message, not doing EAP
Any Idea what to change?