[tedunangst]

sshd also supports online key rotation where it tells clients about new keys, but I think it requires the new key be installed on the server, so it ends up getting compromised at the same time as the existing key.