I found this post which encouraged adding the keys to /etc/ssh/ssh_known_hosts. Having now done that for the host pbs.domain.com.au, I just get the balance of the error:
user@pbs.domain.com.au,: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,hostbased).
Shouldn’t Dex be looking after this? In 1.7 we used basic auth, and all this was looked after for us.