Did some digging.
Rasputniks Golden rule: "if in doubt ask in public and embarrass your brain into
figuring it out"
OpenSSH 7 has deprecated DSA keys, see:
I was a little confused as the version on this Raspbian is reporting as
"OpenSSH_6.7p1 Raspbian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016"
but the client on OS Sierra is 7.x. It's my ssh client that's refusing to use
my unfashionable key, not the server.