An Ubuntu bastion patch run completes and SSH trust breaks

Routine patching succeeds and later automated SSH clients start rejecting the bastion even though no access policy was intentionally changed.