Regression on known_hosts fingerprints management

Description

Probably linked to #40005 and #40878

With Salt server and minion in version 2016.11.5, I experiment many problems with managing known_hosts fingerprints.

The code I provide was working some months ago (sorry for the imprecision, not sure about the version and time).

Error messages

Here are the errors I run into:

[WARNING ] Public Key hashing currently defaults to "md5". This will change to "sha256" in the Nitrogen release.
[ERROR   ] Remote host public key found but its fingerprint does not match one you have provided

Resulting in final message like this:

----------
          ID: known-hosts-server210
    Function: ssh_known_hosts.present
        Name: server210.rodacom.net
      Result: False
     Comment: Remote host public key found but its fingerprint does not match one you have provided
     Started: 17:12:28.007827
    Duration: 376.707 ms
     Changes:   

Setup

{% set allgrains = salt['mine.get']('*', 'grains.items') %}
{% for servname, servconf in pillar.servers|dictsort %}
{% if servconf.domain == grains.domain %}
{% set servfqdn = servname + '.' + servconf.domain %}
{% set fingerprint = allgrains.get(servfqdn, {}).get('ssh_fingerprint', '') %}
{% if fingerprint %}
known-hosts-{{ servname }}:
    ssh_known_hosts.present:
        - name: {{ servfqdn }}
        - user: intercom
        - fingerprint: {{ fingerprint }}
        - fingerprint_hash_type: sha256
        - unless:
            - ssh-keygen -H -f /srv/intercom/.ssh/known_hosts -F {{ servfqdn }}
{% endif %}
{% endif %}
{% endfor %}

Start with the ssh_known_hosts.present state using the supplied Salt 2016.11.5 configuration, especially fingerprint and fingerprint_hash_type handling. Compare the behavior and error against linked issues #40005 and #40878; done means known_hosts fingerprints can be managed without the reported mismatch when the supplied SHA-256 fingerprint is correct.