The fallback was created via cp as root:root 0600 and relied on a separate
chown task to fix ownership. When that chown did not take, sshd could not
read /etc/ssh/authorized_keys/<user> in the unprivileged session, so pubkey
auth failed whenever the encrypted home was locked.
Replace the cp + chown pair with a single idempotent copy that keeps the
file root-owned but world-readable (0644). It contains only public keys, so
0644 is safe and passes StrictModes.
Clément Désiles
ea93eb8c59