[daira]

But you don't detect that one case where you are actually compromised. You dismiss it like you do all the false positives. At best, when you get pwned you think back to having dismissed the key change warning and know what happened, but how does that actually help you?

[scott00]

I actually caught a semi-real one once. My new employer was MITMing all ssh traffic.

[saas_co_de]

this does not follow at all. any time a cert has changed i either know the cause or verify the cause before using the server.