Homebrew does not pick up SSH binary from users $PATH

[MadsRC]

Output of brew config

HOMEBREW_VERSION: 3.6.21
ORIGIN: https://github.com/Homebrew/brew
HEAD: 932d2cf3b77c9439a57b6a43577fc8d3b6399a62
Last commit: 5 days ago
Core tap origin: https://github.com/Homebrew/homebrew-core
Core tap HEAD: afc9c5cbc427072b427fd85725c93a3997c09b7f
Core tap last commit: 13 minutes ago
Core tap branch: master
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_MAKE_JOBS: 10
Homebrew Ruby: 2.6.10 => /System/Library/Frameworks/Ruby.framework/Versions/2.6/usr/bin/ruby
CPU: 10-core 64-bit arm_firestorm_icestorm
Clang: 14.0.0 build 1400
Git: 2.37.1 => /Library/Developer/CommandLineTools/usr/bin/git
Curl: 7.85.0 => /usr/bin/curl
macOS: 13.1-arm64
CLT: 14.2.0.0.1.1668646533
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Please note that these warnings are just used to help the Homebrew maintainers
with debugging if you file an issue. If everything you use Homebrew for is
working fine: please don't worry or file an issue; just ignore this. Thanks!

Warning: Unbrewed dylibs were found in /usr/local/lib.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected dylibs:
  /usr/local/lib/libcrypto.1.1.dylib
  /usr/local/lib/libusb-1.0.0.dylib
  /usr/local/lib/libykhsmauth.2.3.2.dylib
  /usr/local/lib/libyubihsm.2.3.2.dylib
  /usr/local/lib/libyubihsm_http.2.3.2.dylib
  /usr/local/lib/libyubihsm_usb.2.3.2.dylib

Warning: Unbrewed header files were found in /usr/local/include.
If you didn't put them there on purpose they could cause problems when
building Homebrew formulae, and may need to be deleted.

Unexpected header files:
  /usr/local/include/openssl/aes.h
  /usr/local/include/openssl/asn1.h
  /usr/local/include/openssl/asn1_mac.h
  /usr/local/include/openssl/asn1err.h
  /usr/local/include/openssl/asn1t.h
  /usr/local/include/openssl/async.h
  /usr/local/include/openssl/asyncerr.h
  /usr/local/include/openssl/bio.h
  /usr/local/include/openssl/bioerr.h
  /usr/local/include/openssl/blowfish.h
  /usr/local/include/openssl/bn.h
  /usr/local/include/openssl/bnerr.h
  /usr/local/include/openssl/buffer.h
  /usr/local/include/openssl/buffererr.h
  /usr/local/include/openssl/camellia.h
  /usr/local/include/openssl/cast.h
  /usr/local/include/openssl/cmac.h
  /usr/local/include/openssl/cms.h
  /usr/local/include/openssl/cmserr.h
  /usr/local/include/openssl/comp.h
  /usr/local/include/openssl/comperr.h
  /usr/local/include/openssl/conf.h
  /usr/local/include/openssl/conf_api.h
  /usr/local/include/openssl/conferr.h
  /usr/local/include/openssl/crypto.h
  /usr/local/include/openssl/cryptoerr.h
  /usr/local/include/openssl/ct.h
  /usr/local/include/openssl/cterr.h
  /usr/local/include/openssl/des.h
  /usr/local/include/openssl/dh.h
  /usr/local/include/openssl/dherr.h
  /usr/local/include/openssl/dsa.h
  /usr/local/include/openssl/dsaerr.h
  /usr/local/include/openssl/dtls1.h
  /usr/local/include/openssl/e_os2.h
  /usr/local/include/openssl/ebcdic.h
  /usr/local/include/openssl/ec.h
  /usr/local/include/openssl/ecdh.h
  /usr/local/include/openssl/ecdsa.h
  /usr/local/include/openssl/ecerr.h
  /usr/local/include/openssl/engine.h
  /usr/local/include/openssl/engineerr.h
  /usr/local/include/openssl/err.h
  /usr/local/include/openssl/evp.h
  /usr/local/include/openssl/evperr.h
  /usr/local/include/openssl/hmac.h
  /usr/local/include/openssl/idea.h
  /usr/local/include/openssl/kdf.h
  /usr/local/include/openssl/kdferr.h
  /usr/local/include/openssl/lhash.h
  /usr/local/include/openssl/md2.h
  /usr/local/include/openssl/md4.h
  /usr/local/include/openssl/md5.h
  /usr/local/include/openssl/mdc2.h
  /usr/local/include/openssl/modes.h
  /usr/local/include/openssl/obj_mac.h
  /usr/local/include/openssl/objects.h
  /usr/local/include/openssl/objectserr.h
  /usr/local/include/openssl/ocsp.h
  /usr/local/include/openssl/ocsperr.h
  /usr/local/include/openssl/opensslconf.h
  /usr/local/include/openssl/opensslv.h
  /usr/local/include/openssl/ossl_typ.h
  /usr/local/include/openssl/pem.h
  /usr/local/include/openssl/pem2.h
  /usr/local/include/openssl/pemerr.h
  /usr/local/include/openssl/pkcs12.h
  /usr/local/include/openssl/pkcs12err.h
  /usr/local/include/openssl/pkcs7.h
  /usr/local/include/openssl/pkcs7err.h
  /usr/local/include/openssl/rand.h
  /usr/local/include/openssl/rand_drbg.h
  /usr/local/include/openssl/randerr.h
  /usr/local/include/openssl/rc2.h
  /usr/local/include/openssl/rc4.h
  /usr/local/include/openssl/rc5.h
  /usr/local/include/openssl/ripemd.h
  /usr/local/include/openssl/rsa.h
  /usr/local/include/openssl/rsaerr.h
  /usr/local/include/openssl/safestack.h
  /usr/local/include/openssl/seed.h
  /usr/local/include/openssl/sha.h
  /usr/local/include/openssl/srp.h
  /usr/local/include/openssl/srtp.h
  /usr/local/include/openssl/ssl.h
  /usr/local/include/openssl/ssl2.h
  /usr/local/include/openssl/ssl3.h
  /usr/local/include/openssl/sslerr.h
  /usr/local/include/openssl/stack.h
  /usr/local/include/openssl/store.h
  /usr/local/include/openssl/storeerr.h
  /usr/local/include/openssl/symhacks.h
  /usr/local/include/openssl/tls1.h
  /usr/local/include/openssl/ts.h
  /usr/local/include/openssl/tserr.h
  /usr/local/include/openssl/txt_db.h
  /usr/local/include/openssl/ui.h
  /usr/local/include/openssl/uierr.h
  /usr/local/include/openssl/whrlpool.h
  /usr/local/include/openssl/x509.h
  /usr/local/include/openssl/x509_vfy.h
  /usr/local/include/openssl/x509err.h
  /usr/local/include/openssl/x509v3.h
  /usr/local/include/openssl/x509v3err.h
  /usr/local/include/pkcs11/pkcs11.h
  /usr/local/include/pkcs11/pkcs11y.h
  /usr/local/include/ykhsmauth.h
  /usr/local/include/yubihsm.h

Description of issue

It seems that brew doesn't use the SSH version in the user's current $PATH, which is evident from the following command:

mrh@Mrh's-MacBook-Pro ~ % brew tap xxx/homebrew-yyy-tools [email protected]:xxx/homebrew-yyy-tools.git
==> Tapping xxx/yyy-tools
Cloning into '/opt/homebrew/Library/Taps/xxx/homebrew-yyy-tools'...
Load key "/Users/mrh/.ssh/id_ed25519_sk": unknown or unsupported key type
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Error: Failure while executing; `git clone [email protected]:xxx/homebrew-yyy-tools.git /opt/homebrew/Library/Taps/xxx/homebrew-yyy-tools --origin=origin --template=` exited with 128.
mrh@Mrh's-MacBook-Pro ~ % git clone [email protected]:xxx/homebrew-yyy-tools.git
Cloning into 'homebrew-yyy-tools'...
remote: Enumerating objects: 526, done.
remote: Counting objects: 100% (103/103), done.
remote: Compressing objects: 100% (69/69), done.
remote: Total 526 (delta 45), reused 76 (delta 32), pack-reused 423
Receiving objects: 100% (526/526), 82.38 KiB | 466.00 KiB/s, done.
Resolving deltas: 100% (165/165), done.

Now, the reason it works when running git directly is because that's the openssh version installed using brew and not the default MacOS one, which doesn't support FIDO2 security keys.

I've tried exporting GIT_SSH_COMMAND=/opt/homebrew/bin/ssh (which should tell the git command run by brew to use a specific SSH command) before running brew, but I still get the Load key "/Users/mrh/.ssh/id_ed25519_sk": unknown or unsupported key type error, indicating that it is using a version of ssh that doesn't support FIDO2 keys.

I've also tried looking for .gitconfig files around my system to see if there's one somewhere that brew uses, but to no avail.

Does anyone have any idea how to force brew to use the ssh binary in the users $PATH and not whatever version it defaults to?