d7205a911c
ssh re-splits remote command args on spaces, so -- "$PUB" arrived as $1=ssh-ed25519 (the key body and comment became $2/$3). The loose validation passed and grep -qF matched any ed25519 key -> false '[skip] key present'; the key was never added. Pass PUB via env (safe inside remote single-quotes) and require 'ssh-ed25519 AAAA*'. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>