[c7DJTLrn]

Thanks. I linked to the blog post because it was one of the first results in the search engine.

How are you guys tackling host key rotation? Do you do it periodically, or on compromise? How do you protect such an important set of keys?

[MaxBarraclough]

I don't work for them, but: BitBucket changed their SSH keys earlier this year due to possible compromise of their secret keys. [0] I don't think they change them periodically.

[0] https://bitbucket.org/blog/ssh-host-key-changes

edit I see eichin also linked to the same page