Anything returned from NewClientConn in crypto/ssh will "flatten" wrapped errors. There is an issue and a PR at golang/go#61309 golang/crypto#266
This makes some of rig's error wrapping lose all meaning and for example makes k0sctl's retry not give up before the timeout, because using errors.Is(err, rig.ErrCantConnect) is never true.