> yum check-update does not report that there is a more recent openssh
> available.   Odd.

Clear your yum cache?  Since you used yum to update the package in the first place, yum may have stored that "I already downloaded this" data somewhere.

FYI, I am not experienced in yum specifically (debian user here, learning RH based things).

Hope this helps,

Rob