stripping ssh host keys from build

scripts/extract-artifacts.sh

@@ -68,6 +68,17 @@ tar -C "$WORK/root" --numeric-owner --xattrs --xattrs-include='*' --acls --selin
     -xpf "$WORK/rootfs.tar"
 rm -rf "$WORK/root/boot/"* "$WORK/rootfs.tar"   # diskless hosts don't need /boot
 
+# Strip SSH host keys. They are PER-HOST identity (invariant #1) and must not be
+# baked: a baked key means every host shares one SSH identity (MITM risk), and
+# the build VM's key perms/group don't survive the tar->erofs round-trip, so
+# sshd rejects them ("Permissions 640 ... too open") and refuses to start.
+# RHEL's sshd-keygen@.service regenerates them with correct perms before sshd
+# starts, into the writable volatile overlay. NOTE: with the ephemeral overlay
+# they regenerate EVERY boot, so the host key changes each reboot (SSH clients
+# will warn) — for a stable identity, persist them or derive from the TPM
+# (future; ties to the hostnqn/identity model).
+rm -f "$WORK/root/etc/ssh/"ssh_host_*
+
 # Fail loudly if labels didn't make it — shipping an unlabeled enforcing image
 # boots but denies all logins (the symptom we just chased down).
 if ! getfattr -h -n security.selinux "$WORK/root/usr/bin/bash" >/dev/null 2>&1; then