Bug#1142934: openssh-server: ssh_host_mldsa44_ed25519_key.pub not generated by the postinst

On Tue, Jul 28, 2026 at 12:05:18PM +0100, xnox wrote:
>OpenSSH upstream added a new hybrid hostkey type ssh_host_mldsa44_ed25519_key.pub.
>
>It is enabled by default, and can be created with ssh-keygen -A.
>
>The openssh-server postinst script however doesn't use ssh-keygen -A and instead only generates hostkeys of known types and the ones that are configured in the sshd config.
>
>It appears that it currently doesn't know about mldsa44_ed25519 host key type, please add support for this new host key type.

The upstream changelog doesn't suggest to me that it's ready to be 
enabled yet:

  * All: add experimental support for a composite post-quantum
    signature scheme that combines ML-DSA 44 and Ed25519 as specified
    in draft-miller-sshm-mldsa44-ed25519-composite-sigs.

    This scheme is not enabled by default. To use it, you'll need
    to add it to HostKeyAlgorithms, PubkeyAcceptedAlgorithms, etc.
    Keys may be generated using "ssh-keygen -t mldsa44-ed25519".

Yes, it's enabled by default _specifically in ssh-keygen -A_, but it's 
not enabled by default in the rest of OpenSSH, so I think it's too early 
at this point.  I'll wait until upstream declares it to be 
non-experimental.

Thanks,