@neverpanic But why does `ssh` manage to work, while `ssh-keyscan` does not?
When I do `ssh -v ippai.die-welt.net` from an EL9-FIPS box, I see
```
debug1: kex: algorithm: ecdh-sha2-nistp256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
```
While in `ssh-keyscan -v` I only see c25519, and that's forbidden.