Answering my own question: I hadn’t actually installed openssh, so apparently that code was never executed.
services.openssh.enable = true;
Once I had added it, I simplified the regex (the original did not work and I am only doing a sanity check anyway):
type = types.strMatching "^ssh-(ed25519|rsa|dss|ecdsa) AAAA([A-Za-z0-9+=\/@. ]+)$";