x2goclient (on Windows) shows a different ssh host key hash than the output of
ssh-keygen -lf /etc/ssh/ssh_host_key_$cypher_ley.pub -E md5 on the host. Connecting with other ssh clients from the same machine works fine (x2goclient comes with own ssh client).
Interestingly, connecting to different hosts produces different (wrong) host keys. I say interestingly, because I'd imagine a man-in-the-middle attempt to use the same middle-host.
PyHoca (the alternative x2go client) reports the right host keys, but it has strange fatal errors about an invalid EC key when connecting to one host (using pubkey auth), and not being able to find user's home directory with another host (using password auth). Again, connecting to any of these hosts works fine with other ssh clients.
I'm mentioning PyHoca, because, while I initially presumed that it was under-maintained and broken, maybe something more nefarious is taking place. Both of these projects are hosted under https://code.x2go.org
Windows x2goclient version is the latest one (126.96.36.199-2018.06.22) downloaded from the official site. Provided sha1 hash matches.
Is there a non-malicious explanation? Care to suggest next steps?