stripping ssh host keys from build

docs/TODO.md

@@ -64,6 +64,14 @@ and cleanup.
   but document/deviate), and the admin key/user are **fleet-wide baked** — for
   per-host/rotatable access without rebuilds, layer the signed HTTP/SMBIOS
   config-agent or an SSH CA (`TrustedUserCAKeys`) discussed in session.
+- **SSH host keys (done):** `extract-artifacts.sh` strips `/etc/ssh/ssh_host_*`
+  so they're not baked (baked keys = shared fleet identity + the build's
+  perms/group don't survive the tar→erofs round-trip, so sshd rejected them
+  "Permissions 640 too open" and refused to start). RHEL's `sshd-keygen@.service`
+  regenerates them into the overlay before sshd starts. **⚠ Caveat:** the
+  ephemeral overlay means they regenerate **every boot** → the host key changes
+  per reboot (clients warn). Follow-up for a stable host identity: persist the
+  host keys or derive them from the TPM (ties to the hostnqn/identity model).
 
 ## [ ] 3. Roll the errata into design doc v3