How to support older protocols even though they are not secure

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

C:\Users\user>ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -l didi 10.0.7.1
Unable to negotiate with 10.0.7.1 port 22: no matching host key type found. Their offer: ssh-rsa

Expected behavior

%Trying 10.0.7.1, 22,...open
didi@10.0.7.1's password:

Actual behavior

Unable to negotiate with 10.0.7.1 port 22: no matching host key type found. Their offer: ssh-rsa

Error details

Environment data

PS C:\Users\XX> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.26100.1591
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.1591
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version

PS C:\Users\XX> ssh -V OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2

Visuals

No response

Start by reproducing the shown ssh command with OpenSSH_for_Windows 9.5p1 and review how its algorithm negotiation handles the offered ssh-rsa host key and diffie-hellman-group1-sha1. Done should mean the documented legacy connection reaches authentication without weakening unrelated defaults, while preserving the security rationale for disabled algorithms.