[tialaramex]

The algorithms used will be negotiated. So, unless your SSH client is unwilling to use any of the acceptable algorithms it just will work.

For the server's proof of its identity, one gap in older SSH versions is that the client doesn't learn other host keys. So if your client is content with Archaic-host-key, even though the server has been telling anybody new about Shiny-modern-host-key, when the server finally removes Archaic-host-key the client can't verify this server. In modern OpenSSH UpdateHostKeys controls this in clients and defaults to learning new host keys in the most obvious cases.

[yjftsjthsd-h]

You could also deal with updating host keys by signing them and just having clients trust the signing authority.

[haarts]

I liked this article about it: https://smallstep.com/blog/use-ssh-certificates/

[egberts1]

Does it work with closed network like in a whitlab?