I got this working at one point. The trick is to use your SSH config to intercept SSH connections so the got to a local SSH server, this triggers ProxyCommand

I got this working at one point. The trick is to use your SSH config to intercept SSH connections so the got to a local SSH server, this triggers ProxyCommand and let's you create the cert and then forward those packets into an outgoing SSH connection you don't intercept. SSH --> Local SSH Server --> ProxyCommand (create cert) --> SSH --> Remote SSH Server