[lxgr]

This just kicks the can down the road to DNS.

I'd guess that most systems aren't using DoH/DoT or end-to-end DNSSEC yet. Some browsers do, but that doesn't help tooling frequently used on the command line.

I suppose you could just accept X.509 certificates for some large/enterprise git domains, but that pokes up the hornet's nest that is CA auditing (the browser vendors are having a lot of fun with that, I'm happy that the OpenSSH devs don't have to, yet).

And where do you maintain the list that decides which hosts get to use TOFU and which ones are allowed to provide public keys? Another question very ill-fitted for the OpenSSH dev team.

[tptacek]

No browser uses DNSSEC.

[nibbleshifter]

Thank god. Someone needs to take that protocol out back and give it the old yeller treatment.

[lxgr]

That was in reference to the former, i.e. in-browser DoH/DoT lookups.