ssh-keysign is used for host-based authentication, and is designed to be used as SUID-root program. OpenSSH defaults to referencing it from libexec, which cannot be made SUID in Nix.
