Why would it be surprising? 4k and especially 8kbit RSA provide greater assumed security, and the cpu/communication performance of 4/8kbit RSA is perfectly ade

Why would it be surprising? 4k and especially 8kbit RSA provide greater assumed security, and the cpu/communication performance of 4/8kbit RSA is perfectly adequate for SSH. They also provide greater compatibility. Why would I downgrade my cryptographic security to use a different cryptosystem with performance characteristics which aren't very relevant for interactive logins and get reduced compatibility at the same time? I'd be much more interested in an ed448 or a ed25519+SPHINCS+ hybrid for SSH authentication -- at least they wouldn't be unambiguously less secure than what I'm currently using per our best current understanding. Same deal for GPG/PGP: they added ed25519 which has less security than the keys most people were already using (4kbit RSA)... when the performance advantages are essentially irrelevant for the application. The non-performance related advantages seem small relative to to the compatibility and security posture.