Note that HostKeyEkInitString must point to a single private key. Setting the HostKey.Cert.Required option to yes defines that the server must authenticate with a certificate. When the z/OS SAF provider is used, setting the option to no means that only the public key found in the SAF certificate is used. Setting the option to optional means that both the SAF certificate and the public key found in the SAF certificate are used.
For more information on the configuration file options, see sshd2_config. For information on the format of the external key initialization string, see ssh-externalkeys.