D'oh! Putting keyboard-interactive authentication _before_ publickey