The new (?) Wiz controls wc-id-3203 and wc-id-3204 are gold: "compute instances using non-PQC compliant SSH public/authorized keys".
The recommended remediation hallucinates ssh-ed25519 to be a hybrid key (nope https://datatracker.ietf.org/doc/draft-sun-ssh-composite-sigs/) and that the non-hybrid variant will be called ssh-ml-kem-768 (also nope https://datatracker.ietf.org/doc/draft-sfluhrer-ssh-mldsa/).
The support obviously also gets their replies from some LLM which confuses key exchange and signature algorithms. Even when pointed to https://www.openssh.org/pq.html
Composite ML-DSA Signatures for SSH
This document describes the use of PQ/T composite signatures for the Secure Shell (SSH) protocol. The composite signatures described combine ML-DSA as the post-quantum part and the elliptic curve signature schemes ECDSA, Ed25519 and Ed448 as the traditional part.