Another system needed the public key for the CMS. I sent it to them, and it looked like this (generated by ssh-keygen):

ssh-rsa AAAAAbcdEEf001... user@hostname

They said they needed one in this format:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "2048-bit RSA, converted from OpenSSH by user@hostname"
AAAAAbcdEEf001...
---- END SSH2 PUBLIC KEY ----

Fortunately, this did the trick:

# Convert ssh-rsa key to ssh2 key
$ ssh-keygen -e -f ~/.ssh/id_rsa.pub > ~/.ssh/id_rsa_ssh2.pub