It appears that the AuthorizedKeysCommandUser value undergoes %u expansion (auth2-pubkey.c lines 983-984), but this is not mentioned in sshd_config.5.