Arch Linux PAM Expiry Semantics and OpenSSH Public-Key Authentication: Which Account Checks Apply?

Arch Linux delegates local authentication to PAM, where pam_unix reads /etc/shadow. Two shadow fields matter here: password expiry, configured with chage -M, which forces a change at next authentication, and account expiration, set with chage -E, which denies access after the given date. OpenSSH can run with UsePAM yes, yet public-key authentication does not necessarily traverse the same PAM stack as a password login.

The integration question is which expiry semantics survive when a user authenticates with an SSH key instead of a password. Whether the PAM account module runs for pubkey sessions, and therefore whether account expiration is honored, depends on the joint configuration of /etc/pam.d/sshd and sshd_config. Because Arch is a rolling release, these defaults can shift between upgrades, so the behavior should be re-verified rather than assumed.

Specific questions: Does sshd invoke the PAM account phase for publickey-only authentication when UsePAM yes is set? If not, which shadow field, password expiry or account expiry, still blocks a key-based login? And which sshd_config directives determine that outcome?