Why every directive needs a Host (or Match) block above it

OpenSSH's client config format is scoped entirely by the Host (or Match) blocks that precede each directive — a directive doesn't apply globally by default, it applies to whatever the nearest preceding block pattern matches. A directive appearing before any Host block at all is a structural mistake with a very specific consequence: it silently does nothing, since there's no block scope for OpenSSH to attach it to. That kind of silent no-op is exactly the class of mistake worth catching before it costs someone time debugging "why isn't my IdentityFile setting being picked up" days later.

Why unknown directives are informational, not hard errors

OpenSSH adds new client directives fairly regularly across releases, and different OpenSSH versions and platform builds support different directive sets at any given time — a directive that's unrecognized to this tool's list might be perfectly valid on the specific OpenSSH version actually reading the config. Treating an unrecognized directive as a hard error would produce false positives for anyone using a newer directive this tool's list hasn't caught up with yet, which is why it's flagged as worth a second look rather than rejected outright — the tool is deliberately conservative about claiming something is wrong when it genuinely can't be certain.