It would be helpful if the ldap tool calculated the SSH key fingerprints directly (in addition to the full key) to make it easier to match them to keys shown in the SSH authentication log.