I really want to love trellis.. but ansible is in the way!

Within your debug output:

It could be that you’ve connected to this server before, added the ECDSA key. And then after accepting that key maybe you have destroyed the box, and provisioned a new machine generating a new ECDSA key on the server but not cleaning up the existing one on your local machine.

This security measure isn’t specific to Trellis or Ansible but is specific to SSH behaviour and handshakes

Related troubleshooting documentation: Troubleshooting | Trellis Docs | Roots