I had a similar issue, it was caused by explicitly set HostKey algorithms in ansible (SSH client) config.
See https://github.com/roots/trellis/issues/784
and https://github.com/ansible/ansible/issues/22289 .
You could try to comment out the explicit HostKey algorithms list for the initial provisioning.
After a successful Trellis provisioning the SSH server/config is in a well-known working state.