The default _sshd.service_ unit runs `ssh-keygen -A` in `ExecStartPre`,
to ensure host keys exist before starting the SSH daemon.
Unfortunately, this tool does _not_ respect the `HostKey` settings in
`sshd_config`, and unconditionally tries to create the key files in
`/etc/ssh`. Since this directory is not writable, the command fails,
preventing the SSH daemon from starting.
