Match läuft erst ab OpenSSH 5.
Oh, ich merke gerade, ich habe vor Tagen vergessen, zu erwähnen, dass es um den user root geht.
Ich habe herausgefunden, dass wohl PermitRootLogin without-password hilft.
PermitRootLogin
Specifies whether root can log in using ssh(1). The argument
must be ``yes'', ``without-password'', ``forced-commands-only'',
or ``no''. The default is ``yes''.
If this option is set to ``without-password'', password
authentication is disabled for root.
If this option is set to ``forced-commands-only'', root login
with public key authentication will be allowed, but only if the
command option has been specified (which may be useful for taking
remote backups even if root login is normally not allowed). All
other authentication methods are disabled for root.
If this option is set to ``no'', root is not allowed to log in.
http://www.openbsd.org/cgi-bin/man.cgi?query=sshd_config&sektion=5&arch=&apropos=0&manpath=OpenBSD+Current
Da ja PubkeyAuthentication und PasswordAuthentication global aktiv ist, wird wohl für den user root die Authentifizierung per Pubkey erzwungen.