A test pins SSH signature checks: another key, a changed message, an algorithm downgrade and a malformed blob are each refused #6902

src/ssh/keys.ts verifies every SSH sign-in (verifySshSignature, keyAlgorithmMatches, fingerprintOf). No test names these functions; only the end-to-end ssh suite reaches them.

Done:

• [ ] test/ssh-keys.test.ts: for an ed25519 and an RSA key generated in the test, a good signature verifies.
• [ ] Each of these is refused, and none throws: a signature by another key, one byte of the message changed, an rsa-sha2-512 offer answered with an ssh-rsa (SHA-1) signature, and a truncated or garbage blob.
• [ ] keyAlgorithmMatches accepts rsa-sha2-256 over an ssh-rsa blob and nothing else that differs.
• [ ] fingerprintOf prints SHA256: and unpadded base64, the way ssh-keygen -lf does, for a fixed key.

This is a new test file only. Change code only where the test finds a hole, and say so in the pull. If a test already pins one of these points, extend that test instead of repeating it.

Files: test/ssh-keys.test.ts

Before pushing: bun x tsc --noEmit and the test you add. Tests pass now in and never read the wall clock.