Do not depend on the system's ssh package for crypto

[f-f]

There are some operations for which we require strong cryptographic authentication.
We do this by piggybacking on the native ssh executable for the cryptographic bits. This seems to be quite fragile however - different versions of ssh on different operating systems seem to do different things, so we should not rely on the native binary.
Fortunately there is a pure-js package that implements ssh's protocols, and that includes reading keys, signing and verifying payloads, which is all we need here.
We should switch to this package both in the CI here and in the package managers talking to it. The downside is that one would have to use node to perform these operations, but I'd argue that this is a better situation than relying on whatever version one has locally.