This was rather tricky, but I think I've learned a lot more about how SSH actually works. We now only offer up to the server what we can actually support, which lets us actually get back a host key we have a chance of actually authenticating against. Needed a new version of the ssh code and had to mess with go mod garbage.