>"The answer is: using the server's public key which is transmitted to client when establishing the connection." This was true in SSH v1 which is ancient but i

>"The answer is: using the server's public key which is transmitted to client when establishing the connection." This was true in SSH v1 which is ancient but in modern times v2 uses DH and the the server's pub key is only used to sign the DH parameters.