Okay, how do you get the ssh folder contents to validate the remote user, if validating the user is required to decrypt?

You can't. And the systemd answer is that you simply throw away ssh.