Only the ssh host key(s) that show up in 'sshd -T' will have the appropriate mode applied to them

[michael-riddle]

This is definitely a good way to ensure the host key has the appropriate mode, however, if a particular host key isn't called out in the config, the file's mode will be unchanged. Specifically /etc/ssh/ssh_host_ecdsa_key and ssh_host_ed25519_key by default will exist, but not have the more restrictive mode applied to them.

[michael-riddle]

Adding a tidy parameter to clear out unmanaged keys would probably be the most appropriate solution for this.