This looks most useful for the inline/private-key-in-connection case.

For file-based keys, SSHHook already passes key_file to Paramiko as key_filename. Paramiko supports OpenSSH certificates on that path when the certificate is provided as a -cert.pub file or matched next to the private key.

The missing Airflow piece is the private_key extra path. Airflow turns the inline private key into a Paramiko PKey, but it does not currently have a connection extra for the certificate text/path and does not call PKey.load_certificate().

A focused PR could add an extra such as private_key_certificate or private_key_certificate_file, load it into the Paramiko key before connecting, and document the difference from the existing key_file behavior. I would include tests for: file-based key still works, inline private key still works, inline private key plus certificate calls the certificate-loading path, and secrets are not logged.