sha256 & ssh_known_hosts

Description
Fingerprints generated by ssh-keygen in sha256 format aren't accepted by ssh_known_hosts

Setup
Single user machine (not using salt-master. Simply salt-call). Simple file:

github.com:
    ssh_known_hosts:
        - present
        - fingerprint: nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8

Steps to Reproduce the behavior
GitHub's fingerprints can be found here but they can also be obtained via ssh-keyscan

Expected behavior
I expect ssh_known_hosts to accept a valid fingerprint generated by ssh-keygen -l -Esha256 -f <(ssh-keyscan github.com)

Versions Report

$ salt-call --versions-report
Salt Version:
          Salt: 3003.2
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.11.2
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.0
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.9.7
        pygit2: Not Installed
        Python: 3.9.5 (default, May 11 2021, 08:20:37)
  python-gnupg: 0.4.6
        PyYAML: 5.3.1
         PyZMQ: 20.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.4
 
System Versions:
          dist: ubuntu 21.04 hirsute
        locale: utf-8
       machine: x86_64
       release: 5.11.0-31-generic
        system: Linux
       version: Ubuntu 21.04 hirsute

Additional context

I had to go through many hoops before figuring out what fingerprint would be accepted. For the record, here it is:

9d:38:5b:83:a9:17:52:92:56:1a:5e:c4:d4:81:8e:0a:ca:51:a2:64:f1:74:20:11:2e:f8:8a:c3:a1:39:49:8f

Start by locating the ssh_known_hosts state implementation and its fingerprint handling. Reproduce the issue with the SHA256 fingerprint from ssh-keygen and compare it with the accepted format; done means a valid SHA256 fingerprint is accepted without requiring the legacy colon-separated form.