Besides ssh and sshd, OpenSSH ships ssh-keygen, which generates and converts keys and, with -Y sign, produces SSHSIG signatures for files and git commits. The facts here were checked on the Alpine 3.24.2 packages, OpenSSH 10.3p1, linked against the image's OpenSSL 3.5.8. Without -t, ssh-keygen writes an Ed25519 key. ECDSA keys exist only for P-256, P-384 and P-521 (-b 224 is refused), there is no Ed448, and DSA is gone: ssh-keygen -t dsa answers "unknown key type dsa". Inspect any key with the SSH key inspector.
With no configuration file, the client offers the hybrid mlkem768x25519-sha256 key exchange first, then sntrup761x25519-sha512 — post-quantum protection for session keys. ssh -Q sig lists no post-quantum signature algorithm, so host and user authentication remain classical. RSA with SHA-1 (ssh-rsa) is still implemented but missing from the default host-key and public-key lists, so with default settings the client never uses it; a peer that offers nothing newer than ssh-rsa needs it re-enabled explicitly, for example with PubkeyAcceptedAlgorithms +ssh-rsa for user keys. Check what a server negotiates with the SSH server audit.
An ECDSA signature in SSH is neither DER nor raw r‖s: the blob is the string ecdsa-sha2-nistp256 followed by a string holding r and s as SSH mpints (RFC 5656). Converting signatures to or from X.509, JWS or WebAuthn therefore means re-encoding the two integers. Nonces are random — two signatures of one file differed — s is not normalized, and a signature with s replaced by n − s verified.
SSHSIG signatures (ssh-keygen -Y sign) hash the message with SHA-512 by default; -O hashalg=sha256 is the only alternative, and SHA-1 and SHA-384 are refused. The namespace given with -n is part of what is signed, and verifying a file signature as email fails with "namespace does not match". Failures are distinguishable on stderr — "invalid format" for a damaged blob, "incorrect signature" for a valid signature over other data — while stdout says "Could not verify signature." in both cases. Check a signature with the SSH signature verifier.
ssh-keygen -e -m PKCS8 exports a public key as SPKI PEM and -i -m PKCS8 imports it back; -m PEM also gives SPKI for ECDSA but PKCS#1 for RSA, and -m RFC4716 gives the "SSH2 PUBLIC KEY" format. Ed25519 public keys cannot be exported with -e -m PKCS8 ("unsupported key type ED25519"), although -p -m PKCS8 rewrites an Ed25519 private key as PKCS#8. Private keys are stored as OPENSSH PRIVATE KEY by default; -p -m PEM rewrites ECDSA keys as SEC1 and RSA keys as PKCS#1, and -m PKCS8 with a passphrase writes encrypted PKCS#8.