[necovek]

Another point worth bringing up: it'd be nice if we set up either a PGP-like trust ring for host SSH signatures, or relied on a set of CAs like we do for TLS.

Something as simple as confirm-fingerprint-over-https (eg. look for https://ssh-host/.host-ssh-fingerprint) could work if enough ssh clients used it.

[dentarg]

You can do that with DNS (preferably DNSSEC is used): https://en.wikipedia.org/wiki/SSHFP_record, https://man.openbsd.org/ssh_config#VerifyHostKeyDNS