Solaris 11 `ssh-keygen -lf` cannot read ~/.ssh/authorized_keys that have forced `command=` or `from=

~/.ssh/authorized_keys example:

from="192.168.0.*" ssh-rsa AAA[...]= user@host

On Solaris 11, ssh-keygen -lf will fail:

authorized_keys: No such file or directory

On Solaris 10, ssh-keygen -lf works just fine:

2048 11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:00 user@host

Running it under truss it looks for an "authorized_keys.pub" file and exits with a ENOENT error.

As if it confused the public key for a private key and wants to check the public key.

This works fine with the ssh-keygen shipped with Solaris 10, and only fails on Solaris 11.

Perhaps a bug?