The authserver can: call getUser. The getSSHKeys XML-RPC method doesn't distinguish, but the broader authserver does :)
So, if the SFTP server tried a getUser call after getSSHKeys returns no results, it would be able to distinguish between "no such user" and "no keys for user".
It might not be particularly elegant, but I think it'll be good enough.
The authserver can: call getUser. The getSSHKeys XML-RPC method doesn't distinguish, but the broader authserver does :)
So, if the SFTP server tried a getUser call after getSSHKeys returns no results, it would be able to distinguish between "no such user" and "no keys for user".
It might not be particularly elegant, but I think it'll be good enough.