apparently `HostKeyAlgorithms +ssh-rsa` is not enough, i also had to add `PubkeyAcceptedAlgorithms +ssh-rsa` to the config
Best to change UserKnownHostsFile to /dev/null rather than a persistent file. AddKeysToAgent yes IdentitiesOnly yes Both required for successful connection under Catalina/OpenSSH_8.1p1, LibreSSL 2.7.3