For posterity, I had the same issue and fixed it by explicitly setting
ldap_user_ssh_public_key = ipaSshPubKey
in the domain portion of sssd.conf. Otherwise I assume it looks for the attribute "sshPublicKey", since that's what it's called in the sssd cache DB.