You're right, thanks. The trailing ssh: is the comment: changing or removing it leaves the fingerprint the same. The FIDO application ID is also encoded inside the key blob, and it's also "ssh:", which is what confused me. I'll fix the post.