[dotwaffle]

SSHFP records largely solves the host key problem, but yes, the user is the weak point in the chain there.