[fensipens]

SSH relies almost exclusively on the first connection to a server being correct and an attacker being unable to perpetuate a MITM attack against a given host.

Do you rely almost exclusively on the first connection to a server being correct? Apparently. Does SSH? No.

[geofft]

In practice, I have few ways of verifying SSH fingerprints that don't involve trusting the SSL PKI.