I'd agree that the nx user's authorized_keys file should contain this directive by default if it isn't needed by the protocol. Do you know the right place to post a bug?
I do, but this is something I only now realized. Still experimenting with how to fix this...
Cheers, MaZe.