SSH certificate login fails only (authorizedprincipalscommand-returned-bom-prefixed-output)

The certificate and principal are valid, yet one hop inserts invisible bytes that prevent the final host from matching the returned principal.