[cosgroveb]

Is there any way to be sure of an server's ssh fingerprint before logging in? You need to do that offline right? Maybe a PGP signed e-mail from the sysadmin?

[tptacek]

That's exactly the kind of thing you're supposed to do to verify those keys.

(I don't either).

This is a much bigger deal in a web setting, though.