Persistent searching found the original code change that added public-key authentication to ADB. That says:
On the host, the user public/private key pair is automatically generated, if it does not exist, when the adb daemon starts and is stored in $HOME/.android/adb_key(.pub) or in $ANDROID_SDK_HOME on windows. If needed, the ADB_KEYS_PATH env variable may be set to a :-separated (; under Windows) list of private keys, e.g. company-wide or vendor keys.
However, this does not appear to work with recent versions of adb and Android.
I used adb 1.0.41 from platform tools 31.0.2-7242960, running on Windows 10, with a Samsung Galaxy A52s 5G running Android 12. At the start of the experiments, I had the device authorised for USB debugging, and
adb shell working fine. I put the device out of my reach while leaving it connected, so that I would not enable a new key by mistake.
Stop the adb server with
adb kill-server and rename my .android directory as .android.original. Run
adb start-server to generate a new key pair in a new .android directory, and then run
adb devices to verify that the device showed up but was not authorised.
Stop the adb server. Set the ADB_KEYS_PATH environment variable to the full pathname of my .android.original directory. Start the adb server, and then run
adb devices. Result: Device is displayed, but not authorised.
As #2, but setting ADB_KEYS_PATH to the full pathname of my .android.original\adbkey.pub file. Result: as #2.
As #2, but setting ADB_KEYS_PATH to the full pathname of my .android.original\adbkey file. Result: as #2.
Restore original: stop the adb server, remove my .android directory and rename the .android.original directory back to .android. Start the adb server, and then run
adb devices. Result: Device is displayed, and shows as authorised.
Looking at the device screen after completing the full set of trials, it had a stack of dialogs, all offering the chance to accept the new adb key. I hit "Cancel" on all of them.
If anyone with a collection of old Android devices and old adb versions wants to experiment some more, I'd be interested to see the results. I'm reasonably satisfied that it doesn't work with modern adb.
Something that won't work
The ADB_VENDOR_KEYS environment variable is not the answer, unless you work for a device manufacturer and have access to engineering ("eng") builds of Android.