To the best of my knowledge, "gio mount sftp://example.com" works by running "ssh example.com -s sftp".
It cannot use libssh (used by qemu); nor libssh2 (used by curl), nor dropbear dbclient[0].

To make this a little more obvious, please add "Suggests: openssh-client" to debian/control.

[0] https://sources.debian.org/src/gvfs/1.50.2-2/daemon/gvfsbackendsftp.c/#L247-L261
https://sources.debian.org/src/gvfs/1.50.2-2/daemon/gvfsbackendsftp.c/#L480-L520

Hello,

Bug #1020399 in gvfs reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/gnome-team/gvfs/-/commit/3a1d552147167898fce406f096a26672efc6a9d1
------------------------------------------------------------------------
d/control: gvfs-backends Suggests openssh-client, for sftp://

Closes: #1020399
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1020399

We believe that the bug you reported is fixed in the latest version of
gvfs, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1020399@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon McVittie <smcv@debian.org> (supplier of updated gvfs package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 12 Aug 2025 10:24:40 +0100
Source: gvfs
Architecture: source
Version: 1.57.2-3
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1020399 1110399 1110689
Changes:
 gvfs (1.57.2-3) unstable; urgency=medium
 .
   * Team upload
 .
   [ Bastian Germann ]
   * gvfs-backends: Drop google backend.
     This relies on libgdata, which is de facto unmaintained upstream, still
     depends on libsoup2.4, and is likely to be removed from forky.
     (Closes: #1110399)
 .
   [ Simon McVittie ]
   * d/control: Demote wsdd to Suggests.
     It wasn't released in trixie (but will hopefully be in forky) and is
     required for non-essential functionality (browsing SMB/CIFS shares
     exported by newer versions of Windows that no longer use NMB). If
     a particular desktop environment wants this functionality as a
     higher priority, pulling in wsdd via a desktop metapackage like
     ubuntu-desktop or gnome seems more proportionate.
     (Closes: #1110689)
   * d/control: gvfs-backends Suggests openssh-client, for sftp://
     (Closes: #1020399)
Checksums-Sha1:
 5647334d5ca7f25f8904434c165eba1f075e5639 3611 gvfs_1.57.2-3.dsc
 4d44dd5b2b59b220bf9863191bee6e346e4506b1 27736 gvfs_1.57.2-3.debian.tar.xz
 f792493fbc8d1665677c8dd1f9653146540239df 14677 gvfs_1.57.2-3_source.buildinfo
Checksums-Sha256:
 410d8746708785b32b9f38fe75ad0b447f723b9f2f64f1979bbcf5a7acd97b3c 3611 gvfs_1.57.2-3.dsc
 2c26d382783955c923b013bc34e146f674009b1c9542f7546ae9cfeca89cbf4f 27736 gvfs_1.57.2-3.debian.tar.xz
 b0b958c77099969521ba829dd0c9720c0b86ffcc41bb79276584f19946b23735 14677 gvfs_1.57.2-3_source.buildinfo
Files:
 8132d63a6fa9e48f34e0fdd6471c2a1d 3611 gnome optional gvfs_1.57.2-3.dsc
 2972845915aa30b9d1125399dbd31fc9 27736 gnome optional gvfs_1.57.2-3.debian.tar.xz
 9a45a49fc9f3b0a0f95b6e496a5a19da 14677 gnome optional gvfs_1.57.2-3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmibHp0ACgkQI1wJnT6z
MHY+ZQ/6A4ocu3GzVK3/dGPSFktgjbYGRQbzVwJgQMelCxru5OpU54wntY32SHJB
mq6D/Zonb1x30wqQ7+cToX6gHkc5CmkN5+ZEp/lW476mn2fMGZGM1w3jr6mNNMXA
YUGFKA3KMB3L/bsSuAGy+gzWtlejdaBb+NBpPByZ7CWp5ld/V3zKgWfgQXA0Tg91
RWZun+gSsDoxKjTArsJcHVd1bnTqG1ANcWKGRSBEMyljD94fC4vsagQCksRFkW3z
2+CUmV28Thh5Yn+dY5FdZj9BsgjQm4ghVHzk0omBnrG/d/9X+GBapIy3D91O2UFL
yKsrhXKThVmMRkYRx6nQp+RNBYdnpui07ekEkDIFgDvfVDtnDgeRUEFhjh/9KXtA
QH/j8IHjhcynVsj0HAJVH+vRnhBspYQggsGZ8TihsMc+vbo5FiY6tn5vbWKk47b+
6ID2RzfJSpMCEspw4ZmiuvuDgUjtwuOV4KsRiM8RFL/WnJqIzX2JIY6yiqil96zG
fuEG2E4BRa1OIxukuVR4ouYbxBGiib3FGyUuH/5VsoptYaFyCrTnmUVhNvi8+oT7
CHdIX4EaxxF+oW2E2RiEetrI0NxIkUjOaAR6dmoynhYwq/kx+H9OhmL+HipayCM8
KOtePVOiX1ai7E90DA12uP4x3Z6YR0Mu0o4WDCU3TXDsb32RjKI=
=rpXa
-----END PGP SIGNATURE-----