If my server doesn't have any RSA public keys in its authorized_keys, only ed25519 keys; does this backdoor just not work?
The only real way to be sure it's not on your system is if your liblzma version is strictly less than 5.6.0 (first infected version):
ls -al $(ldd $(which sshd) | grep lzma | awk '{ print $3 }')It is executed before that step. So just make sure you are not affected.