Fix minor warnings

src/cs/Ssh/Algorithms/ECDsa.cs

@@ -130,9 +130,9 @@ public KeyPair(string keyAlgorithmName)
 		/// Use this constructor when the ECDSA private key is non-exportable
 		/// (for example, backed by CNG/KSP from a certificate imported by the
 		/// Azure Key Vault VM extension). The SSH library will call
-		/// <see cref="System.Security.Cryptography.ECDsa.SignData"/> and
-		/// <see cref="System.Security.Cryptography.ECDsa.VerifyData"/> on the
-		/// provided instance directly, without ever needing to export raw key material.
+		/// <see cref="System.Security.Cryptography.ECDsa.SignData(byte[], int, int, HashAlgorithmName)"/> and
+		/// <see cref="System.Security.Cryptography.ECDsa.VerifyData(byte[], int, int, byte[], HashAlgorithmName)"/>
+		/// on the provided instance directly, without ever needing to export raw key material.
 		/// </remarks>
 		public KeyPair(System.Security.Cryptography.ECDsa algorithm)
 		{
@@ -143,7 +143,9 @@ public KeyPair(System.Security.Cryptography.ECDsa algorithm)
 
 			// Determine the curve from the public key parameters (always exportable).
 			var p = algorithm.ExportParameters(false);
+#pragma warning disable CA1308 // Normalize strings to uppercase
 			var curveName = p.Curve.Oid?.FriendlyName?.ToLowerInvariant() ?? string.Empty;
+#pragma warning restore CA1308 // Normalize strings to uppercase
 			if (curveName.StartsWith("ecdsa_p", StringComparison.Ordinal))
 			{
 				curveName = "nistp" + curveName.Substring(7);

src/cs/Ssh/Algorithms/Rsa.cs

@@ -87,8 +87,9 @@ public KeyPair(int? keySizeInBits = null)
 		/// Use this constructor when the RSA private key is non-exportable
 		/// (for example, backed by CNG/KSP from a certificate imported by the
 		/// Azure Key Vault VM extension). The SSH library will call
-		/// <see cref="RSA.SignData"/> and <see cref="RSA.VerifyData"/> on the
-		/// provided instance directly, without ever needing to export raw key material.
+		/// <see cref="RSA.SignData(byte[], int, int, HashAlgorithmName, RSASignaturePadding)"/> and
+		/// <see cref="RSA.VerifyData(byte[], int, int, byte[], HashAlgorithmName, RSASignaturePadding)"/>
+		/// on the provided instance directly, without ever needing to export raw key material.
 		/// </remarks>
 		public KeyPair(RSA algorithm)
 		{

src/cs/Ssh/IO/Buffer.cs

@@ -130,8 +130,8 @@ public byte[] ToArray()
 		return Copy().Array;
 	}
 
-#if SSH_ENABLE_SPAN
 #pragma warning disable CA2225 // Operator overloads have named alternates
+#if SSH_ENABLE_SPAN
 
 	public Span<byte> Span => new Span<byte>(Array, Offset, Count);
 
@@ -141,13 +141,13 @@ public byte[] ToArray()
 
 	public static implicit operator Memory<byte>(Buffer buffer) => buffer.Memory;
 
-#pragma warning restore CA2225 // Operator overloads have named alternates
 #endif
 
 	public static implicit operator Buffer(byte[] array)
 	{
 		return Buffer.From(array ?? System.Array.Empty<byte>());
 	}
+#pragma warning restore CA2225 // Operator overloads have named alternates
 
 	public override bool Equals(object? obj)
 	{

src/cs/Ssh/Services/KeyExchangeService.cs

@@ -385,6 +385,7 @@ private async Task HandleMessageAsync(
 		var clientExchangeValue = message.E;
 		var serverExchangeValue = keyExchange.StartKeyExchange();
 		var sharedSecret = keyExchange.DecryptKeyExchange(clientExchangeValue);
+
 		// RFC 8332 §3: Host key blob MUST use "ssh-rsa", not the signature algorithm name.
 		// PuTTY-based clients (FileZilla, WinSCP) reject host keys with wrong key type.
 		var hostKeyAndCerts = privateKey.GetPublicKeyBytes(publicKeyAlg.KeyAlgorithmName);