atgc key add and key create refuse FIDO-backed SSH keys (sk-ssh-ed25519@openssh.com, sk-ecdsa-sha2-nistp256@openssh.com) on purpose (src/clients/git/ssh.rs:43-66). Accepting them means atgc publishes a new kind of credential, and that needs human approval. #1300 closed without tracking this.
Decision needed: should atgc publish sk-* keys as org.tangled.key.sshKey records? Before deciding, check that the knot's SSH server accepts them.