Don't set PasswordAuthentication=no here because the connection plugin will do that unless a password is actually specified with -k/--ask-pass.