Use openssl to encrypt an unencrypted private ssh key. Don’t overwrite the unencrypted one if you don’t want to.

# openssl rsa -aes256 -in ~/.ssh/id_rsa -out ~/.ssh/id_rsa.enc