For posterity, I had the same issue and fixed it by explicitly setting

    ldap_user_ssh_public_key = ipaSshPubKey

in the domain portion of sssd.conf. Otherwise I assume it looks for the attribute "sshPublicKey", since that's what it's called in the sssd cache DB.