Certificates aren't properly added to the ssh-agent service in 8.9.1.0

Please answer the following

"OpenSSH for Windows" version
8.9.1.0

Server OperatingSystem
Ubuntu 20.04

Client OperatingSystem
Windows 11

What is failing

I can't add a certificate to the agent properly. The agent either contains the private key or the certificate (however that works internally) but not both as it should.

Expected output

PS C:\Users\StefanFritsch\.ssh> ssh-add
Enter passphrase for C:\Users\StefanFritsch/.ssh/id_rsa:
Identity added: C:\Users\StefanFritsch/.ssh/id_rsa (C:\Users\StefanFritsch/.ssh/id_rsa)
Certificate added: C:\Users\StefanFritsch/.ssh/id_rsa-cert.pub (stefan.fritsch at 2022-06-15 07:59:21 user key valid for 10h)

PS C:\Users\StefanFritsch\.ssh> ssh-add -l
4096 SHA256:<snip> /home/stefan.fritsch/.ssh/id_rsa (RSA)
4096 SHA256:<snip> /home/stefan.fritsch/.ssh/id_rsa (RSA-CERT)

PS C:\Users\StefanFritsch\.ssh> ssh control-0
Last login: Wed Jun 15 07:57:13 2022 from 80.81.8.105
stefan.fritsch@control-0:~$

Actual output

PS C:\Users\StefanFritsch\.ssh> ssh-add
Enter passphrase for C:\Users\StefanFritsch/.ssh/id_rsa:
Identity added: C:\Users\StefanFritsch/.ssh/id_rsa (C:\Users\StefanFritsch/.ssh/id_rsa)
Certificate added: C:\Users\StefanFritsch/.ssh/id_rsa-cert.pub (stefan.fritsch at 2022-06-15 07:59:21 user key valid for 10h)

PS C:\Users\StefanFritsch\.ssh> ssh-add -l
4096 SHA256:<snip> C:\Users\StefanFritsch/.ssh/id_rsa (RSA-CERT)

PS C:\Users\StefanFritsch\.ssh> ssh control-0
Enter passphrase for key 'C:\Users\StefanFritsch/.ssh/id_rsa':

Context

1. If I first get the certificate and then add the key the above happens, i.e. I have to provide a password to login, but agent forwarding works, i.e. I can then login from control-0 into a different server without problems

2. If I first delete any old certificates, then add the key and then get a new certificate I can log into control-0 but agent forwarding is broken - i.e. the agent simply doesn't contain the certificate.

3. If I delete old certificates, add the key, get a new certificate and then add the key again it's the same as above - i.e. only the certificate shows up in the agent and I can't login with the agent.

4. This used to work in the 8.0.0.1 release on chocolatey but no longer works with the 8.9.1.0 msi from github

5. Restarting the agent doesn't help

6. Re-adding the key doesn't help

7. I tried adding the path with only "/" instead of "" as that was a problem in earlier versions but it didn't make a difference

8. After entering the password it connects just fine and as mentioned above I can then use the key and certificate in the agent (via forwarding) to connect to further servers.

Debugging Output

PS C:\Users\StefanFritsch> get-command ssh

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Application     ssh.exe                                            8.9.1.0    C:\Program Files\OpenSSH\ssh.exe

PS C:\Users\StefanFritsch> get-command ssh-add

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Application     ssh-add.exe                                        8.9.1.0    C:\Program Files\OpenSSH\ssh-add.exe

The service is also at the same path.

Start by reproducing the reported sequences with ssh-add, ssh-add -l, and ssh control-0 on OpenSSH 8.9.1.0, comparing certificate-before-key and key-before-certificate behavior. Done means the agent retains both the private key and certificate, direct login works without another passphrase, and agent forwarding remains functional.