An SSH CA signs the right principal, but a restrictive source-address critical option excludes the bastion's NAT range

Certificate auth looks correct until network translation changes the apparent client source.