Versions of TPP up to 19.1 (currently)
The default SSH report indicates a status of having "Untracked Keys" which may be, or seem, inaccurate:
Checking the keys in the system indicates that we have what is necessary, according to the documentation, which indicates they should be discovered:
"Alert – provides information on keys untracked in SSH key manager and keys used from unknown client. .... For example, in case of untracked keys, you can install agents on those clients so that the keys will be found during key discovery." (19.1 documentation)
This is actually working as designed, but the documentation is slightly misleading. Simply discovering the certificate isn't enough, we need to also collect and MANAGE the keys as well. The status of "Untracked" indicates the key is "not managed", not just "not known".
Either ignore the error, or ensure we are actually managing those keys.