rocks sync config, which calls rocks report knownhosts adds known ssh keys for nodes that aren't part of host-based ssh configuration. This is a bug