DBeaver SSH tunnel vs PostgreSQL JDBC sslmode: independent layers or silent override?

DBeaver SSH tunnel and PostgreSQL JDBC sslmode interoperability

Goal: confirm whether DBeaver's built-in SSH tunnel host-key verification and the PostgreSQL JDBC driver's sslmode setting enforce encryption independently, or whether one layer can silently bypass the other when the tunnel forwards a local port and the JDBC URL points to localhost.

SSH tunneling and JDBC TLS are separate configuration boundaries in DBeaver. The tunnel authenticates the SSH host and forwards traffic; sslmode is a driver property that may secure only the localhost leg unless the remote PostgreSQL server also requires TLS. Disabling SSH host-key verification can expose the tunnel to man-in-the-middle attacks even when JDBC SSL appears enabled.

Available SSH host-key policies, encrypted-key and agent support, and JDBC sslmode values depend on DBeaver edition and version, so behavior should be confirmed in the installed build rather than assumed.

Do SSH host-key verification failures abort the tunnel before JDBC sslmode is evaluated? Can a disabled host-key policy silently weaken an sslmode require connection? Which layer's encryption applies to the remote host leg versus the forwarded localhost leg?