dropbear rejected the (correct, matching) baked key with 'Permission denied (publickey)' because root's home was '/' — dropbear refuses authorized_keys under a loosely-permed home dir. Move root's home to a dedicated /root (0700) with ~/.ssh 0700 + authorized_keys 0600, baked there instead of /.ssh. Interactive shells are unaffected (they use HOME=/tmp). js_start_ssh now checks /root/.ssh/authorized_keys and logs which auth mode it picked.