Credits to @directhex

It is possible for PKG_CHECK_MODULES(LIBSSH2 libssh2) to LIBSSH2_LIBRARIES to a string with more than one library in it - e.g. if your libssh2 was built against libgcrypt, it will be "ssh2;gcrypt"

Quoting the string is needed, or CHECK_LIBRARY_EXISTS will fail.