Turn on ssh-rsa for only the hosts that require that option

config

# Add this to the ~/.ssh/config file
#

Match Exec "ssh-rsa-needed.sh '%n' '%C' '%l' '%h' '%p' '%r'"
    PubkeyAcceptedKeyTypes +ssh-rsa

ssh-rsa-needed.sh

#!/usr/bin/env bash

exec 1>&2

# standard extensible cleanup trap function
declare -a _bash_cleanup_files
declare -a _bash_cleanup_dirs
_bash_cleanup() {
    test 0 -ge "${#_bash_cleanup_files[*]}" ||
        rm -f "${_bash_cleanup_files[@]}"

    test 0 -ge "${#_bash_cleanup_dirs[*]}" ||
        rm -rf "${_bash_cleanup_dirs[@]}"
}
trap _bash_cleanup EXIT

# ensure a private temporary directory
_basename_0="$(basename "$0")"
_tmpdir="$(mktemp -d -t "${_basename_0}.XXXXXXXXXX")"
test -n "${_tmpdir}" &&
    _bash_cleanup_dirs+=("${_tmpdir}")
test -d "${_tmpdir}" || exit 1
chmod 0700 "${_tmpdir}"
TMPDIR="${_tmpdir}"
unset -v _tmpdir
unset -v _basename_0

now="${EPOCHSECONDS}"
fresh_seconds="$(( 60 * 60 * 24 * 7 ))"

original_host="$1"
destination_hash="$2"
local_full_host="$3"
remote_host="$4"
remote_port="$5"
remote_user="$6"

flag_dir=~/.config/ssh/.ssh-rsa-needed
flag_file="${flag_dir}/${destination_hash}"
ssh_log_file="${TMPDIR}/${destination_hash}.log"

if [ -s "${flag_file}" ] && grep -q -F 'version' "${flag_file}"; then
    grep -q -F ': send_pubkey_test: no mutual signature algorithm' "${flag_file}" || exit 2
    created="$(head -n 1 "${flag_file}")"
    delta="$(( now - created ))"
    test "${delta}" -lt "${fresh_seconds}" && exit 0
    rm -f "${flag_file}"
else
    rm -rf "${flag_file}"
    mkdir -p "${flag_dir}"
fi

ssh -F none -v -o BatchMode=yes -E "${ssh_log_file}" -l "${remote_user}" -p "${remote_port}" "${remote_host}" true
ssh_returned=$?
                                                  
echo "${now}" >> "${flag_file}"
grep -F version "${ssh_log_file}" >> "${flag_file}"
grep -F ': send_pubkey_test: no mutual signature algorithm' "${ssh_log_file}" >> "${flag_file}"
printf -- '%s\n' "$@" "ssh Returned: ${ssh_returned}" >> "${flag_file}"

if grep -q -F ': send_pubkey_test: no mutual signature algorithm' "${ssh_log_file}"
then
    exit 0
fi

exit 1