How to update ssh keys?

Preferred:
  * **ssh keymaster.freebsd.org** and follow the instructions.
    * This allows you to do most simple updates yourself.
    * Complex cases (eg: custom from= restrictions) will not work, see alternatives below.  
    * Wait at least 10 minutes for updates to propagate from ldap to sshd.
    * Use **ssh keycheck.freebsd.org** to confirm that you are not depending on legacy protocols or legacy keys.

Alternatives:
  * Send an email message to accounts@%%FreeBSD%%.org that:
    * is signed with the private key corresponding to the [[https://docs.freebsd.org/en/articles/pgpkeys/#pgpkeys-developers|public key in the document]];
    * has your new key(s) attached;
    * clearly states your intent (e.g., whether this is a complete key replacement, a partial one, or an addition);
    * contains a hash (sha256 or md5) of each key that you intended to send.
  * Fallback: Put your new keys in a file (eg: ~/new-ssh-keys) on freefall, then send a message to accounts@ (as above, but without the attached key(s).
  * In desperation: Do the same sort of routine that new committers do: identify a committer who is willing to send the keys, and who is willing to vouch that the keys do actually correspond to you.
  * Please be clear - if you want an additional key added, rather than deleting your old ones, be sure to say so.

NOTE:
  * The ssh-dss key support is disabled **by default** on newer openssh (and %%FreeBSD%%) in **both the client and the server**.
  * To log in with a modern client you will need to enable dsa keys before it will even try.
    * ... even if you specify a dsa key with -i explicitly.  It just won't even try it.
  * To enable ssh-dss/DSA keys on the client: **ssh -oHostKeyAlgorithms=+ssh-dss user@host**.
  * You may also require **-oKexAlgorithms=+diffie-hellman-group1-sha1**.
  * Use **ssh -v** to debug your connection attempts before calling for help.
  * See [[https://www.openssh.com/legacy.html|the openssh legacy protocol documentation]].